July 2018 - cypherpunks-legacy

[IP] An Open Letter to Google: Concepts for a Google Privacy
by David Farber 06 Jul '18

06 Jul '18

Initiative X-Mailer: Apple Mail (2.749.3) Reply-To: dave(a)farber.net Begin forwarded message:

1 0

[liberationtech] Transcript of Richard Stallman's Lecture on Oct 19
by Yosem Companys 06 Jul '18

06 Jul '18

http://www.libertesnumeriques.net/evenements/stallman-19octobre2011/a-free-… Richard Stallman: Projects with the goal of digital inclusion are making a big assumption. They are assuming that participating in a digital society is good; but thatbs not necessarily true. Being in a digital society can be good or bad, depending on whether that digital society is just or unjust. There are many ways in which our freedom is being attacked by digital technology. Digital technology can make things worse, and it will, unless we fight to prevent it. Therefore, if we have an unjust digital society, we should cancel these projects for digital inclusion and launch projects for digital extraction. We have to extract people from digital society if it doesnbt respect their freedom; or we have to make it respect their freedom. [Surveillance] What are the threats? First, surveillance. Computers are Stalinbs dream: they are ideal tools for surveillance, because anything we do with computers, the computers can record. They can record the information in a perfectly indexed searchable form in a central database, ideal for any tyrant who wants to crush opposition. Surveillance is sometimes done with our own computers. For instance, if you have a computer thatbs running Microsoft Windows, that system is doing surveillance. There are features in Windows that send data to some server. Data about the use of the computer. A surveillance feature was discovered in the iPhone a few months ago, and people started calling it the b spy-phone.b Flash player has a surveillance feature too, and so does the Amazon b Swindle.b They call it the Kindle, but I call it the Swindle (lbescroc) because itbs meant to swindle users out of their freedom. It makes people identify themselves whenever they buy a book, and that means Amazon has a giant list of all the books each user has read. Such a list must not exist anywhere. Most portable phones will transmit their location, computed using GPS, on remote command. The phone company is accumulating a giant list of places that the user has been. A German MP in the Green Party asked the phone company to give him the data it had about where *he* was. He had to sue, he had to go to court to get this information. And when he got it, he received forty-four thousand location points for a period of six months! Thatbs more than two hundred per day! What that means is someone could form a very good picture of his activities just by looking at that data. We can stop our own computers from doing surveillance on us if we have control of the software that they run. But the software these people are running, they donbt have control over. Itbs non-free software, and thatbs why it has malicious features, such as surveillance. However, the surveillance is not always done with our own computers, itbs also done at one remove. For instance ISPs in Europe are required to keep data about the userbs internet communications for a long time, in case the State decides to investigate that person later for whatever imaginable reason. With a portable phone b even if you can stop the phone from transmitting your GPS location, the system can determine the phonebs location approximately, by comparing the time when the signals arrive at different towers. So the phone system can do surveillance even without special cooperation from the phone itself. Likewise, the bicycles that people rent in Paris. Of course the system knows where you get the bicycle and it knows where you return the bicycle, and Ibve heard reports that it tracks the bicycles as they are moving around as well. So they are not something we can really trust. But there are also systems that have nothing to do with us that exist only for tracking. For instance, in the UK all car travel is monitored. Every carbs movements are being recorded in real time and can be tracked by the State in real time. This is done with cameras on the side of the road. Now, the only way we can prevent surveillance thatbs done at one remove or by unrelated systems is through political action against increased government power to track and monitor everyone, which means of course we have to reject whatever excuse they come up with. For doing such systems, no excuse is valid b to monitor everyone. In a free society, when you go out in public, you are not guaranteed anonymity. Itbs possible for someone to recognize you and remember. And later that person could say that he saw you at a certain place. But that information is diffuse. Itbs not conveniently assembled to track everybody and investigate what they did. To collect that information is a lot of work, so itbs only done in special cases when itbs necessary. But computerized surveillance makes it possible to centralize and index all this information so that an unjust regime can find it all, and find out all about everyone. If a dictator takes power, which could happen anywhere, people realize this and they recognize that they should not communicate with other dissidents in a way that the State could find out about. But if the dictator has several years of stored records, of who talks with whom, itbs too late to take any precautions then. Because he already has everything he needs to realize: b OK this guy is a dissident, and he spoke with him. Maybe he is a dissident too. Maybe we should grab him and torture him.b So we need to campaign to put an end to digital surveillance now. You canbt wait until there is a dictator and it would really matter. And besides, it doesnbt take an outright dictatorship to start attacking human rights. I wouldnbt quite call the government of the UK a dictatorship. Itbs not very democratic, and one way it crushes democracy is using surveillance. A few years ago, people believed to be on their way to a protest; they were going to protest. They were arrested before they could get there, because their car was tracked through this universal car tracking system. [Censorship] The second threat is censorship. Censorship is not new, it existed long before computers. But 15 years ago, we thought that the Internet would protect us from censorship, that it would defeat censorship. Then, China and some other obvious tyrannies went to great lengths to impose censorship on the Internet, and we said: b well thatbs not surprising, what else would governments like that do?b But today we see censorship imposed in countries that are not normally thought of as dictatorships, such as for instance the UK, France, Spain, Italy, Denmarkb& They all have systems of blocking access to some websites. Denmark established a system that blocks access to a long list of webpages, which was secret. The citizens were not supposed to know how the government was censoring them, but the list was leaked, and posted on WikiLeaks. At that point, Denmark added the WikiLeaks page to its censorship list. So, the whole rest of the world can find out how Danes are being censored, but Danes are not supposed to know. A few months ago, Turkey, which claims to respect some human rights, announced that every Internet user would have to choose between censorship and more censorship. Four different levels of censorship they get to choose! But freedom is not one of the options. Australia wanted to impose filtering on the Internet, but that was blocked. However Australia has a different kind of censorship: it has censorship of links. That is, if a website in Australia has a link to some censored site outside Australia, the one in Australia can be punished. Electronic Frontier Australia, that is an organization that defends human rights in the digital domain in Australia, posted a link to a foreign political website. It was ordered to delete the link or face a penalty of $11,000 a day. So they deleted it, what else could they do? This is a very harsh system of censorship. In Spain, the censorship that was adopted earlier this year allows officials to arbitrarily shut down an Internet site in Spain, or impose filtering to block access to a site outside of Spain. And they can do this without any kind of trial. This was one of the motivations for the* Indignados*, who have been protesting in the street. There were protests in the street in Turkey as well, after that announcement, but the government refused to change its policy. We must recognize that a country that imposes censorship on the Internet is not a free country. And is not a legitimate government either. [Restricted data formats] The next threat to our freedom comes from data formats that restrict the users. Sometimes itbs because the format is secret. There are many application programs that save the userbs data in a secret format, which is meant to prevent the user from taking that data and using it with some other program. The goal is to prevent interoperability. Now, evidently, if the program implements a secret format, thatbs because the program is not free software. So this is another kind of malicious feature. Surveillance is one kind of malicious feature that you find in some non-free programs; using secret formats to restrict the users is another kind of malicious feature that you also find in some non-free programs. But if you have a free program that handles a certain format, *ipso facto* that format is not secret. This kind of malicious feature can only exist in a non-free program. Surveillance features could theoretically exist in a free program but you donbt find them happening. Because the users would fix it. The users wouldnbt like this, so they would fix it. In any case, we also find secret data formats in use for publication of works. You find secret data formats in use for audio, such as music, for video, for booksb& And these secret formats are known as Digital Restrictions Management, or DRM, or digital handcuffs (les menottes numC)riques). So, the works are published in secret formats so that only proprietary programs can play them, so that these proprietary programs can have the malicious feature of restricting the users, stopping them from doing something that would be natural to do. And this is used even by public entities to communicate with the people. For instance Italian public television makes its programs available on the net in a format called VC-1, which is a standard supposedly, but itbs a secret standard. Now I canbt imagine how any publicly supported entity could justify using a secret format to communicate with the public. This should be illegal. In fact I think all use of Digital Restrictions Management should be illegal. No company should be allowed to do this. There are also formats that are not secret but almost might as well be secret, for instance Flash. Flash is not actually secret but Adobe keeps making new versions, which are different, faster than anyone can keep up and make free software to play those files; so it has almost the same effect as being secret. Then there are the patented formats, such as MP3 for audio. Itbs bad to distribute audio in MP3 format! There is free software to handle MP3 format, to play it and to generate it, but because itbs patented in many countries, many distributors of free software donbt dare include those programs; so if they distribute the GNU+Linux system, their system doesnbt include a player for MP3. As a result if anyone distributes some music in MP3 thatbs putting pressure on people not to use GNU/Linux. Sure, if youbre an expert you can find a free software and install it, but there are lots of non experts, and they might see that they installed a version of GNU/Linux which doesnbt have that software, and it wonbt play MP3 files, and they think itbs the systembs fault. They donbt realize itbs MP3b2s fault. But this is the fact. Therefore, if you want to support freedom, donbt distribute MP3 files. Thatbs why I say if youbre recording my speech and you want to distribute copies, donbt do it in a patented format such as MPEG-2, or MPEG-4, or MP3. Use a format friendly to free software, such as the Ogg format or WebM. And by the way, if you are going to distribute copies of the recording, please put on it the Creative Commons-No derivatives license<http://creativecommons.org/licenses/by-nd/3.0/>. This is a statement of my personal views. If it were a lecture for a course, if it were didactic, then it ought to be free, but statements of opinion are different. [Software that isn't free] Now this leads me to the next threat which comes from software that the users donbt have control over. In other words: software that isnbt free, that is not b libreb. In this particular point French is clearer than English. The English word free means blibreb and bgratuitb, but what I mean when I say free software is blogiciel libreb. I donbt mean bgratuitb. Ibm not talking about price. Price is a side issue, just a detail, because it doesbnt matter ethically. You know if i have a copy of a program and I sell it to you for one euro or a hundred euros, who cares?Why should anyone think that thatbs good or bad? Or suppose I gave it to you bgratuitementbb& still, who cares? But whether this program respects your freedom, thatbs important! So free software is software that respects usersb freedom. What does this mean? Ultimately there are just two possibilities with software: either the users control the program or the program controls the users. If the users have certain essential freedoms, then they control the program, and those freedoms are the criterion for free software. But if the users donbt fully have the essential freedoms, then the program controls the users. But somebody controls that program and, through it, has *power* over the users. So, a non-free program is an instrument to give somebody *power* over a lot of other people and this is unjust power that nobody should ever have. This is why non-free software (les logiciels privateurs, qui privent de la libertC)), why proprietary software is an injustice and should not exist; because it leaves the users without freedom. Now, the developer who has control of the program often feels tempted to introduce malicious features to *further* exploit or abuse those users. He feels a temptation because he knows he can get away with it: because his program controls the users and the users do not have control of the program, if he puts in a malicious feature, the users canbt fix it; they canbt remove the malicious feature. Ibve already told you about two kinds of malicious features: surveillance features, such as are found in Windows, and the Iphone and Flash player, and the b Swindleb. And there are also features to restrict users, which work with secret data formats, and those are found in Windows, Macintosh, the Iphone, Flash player, the Amazon b Swindleb, the Playstation 3 and lots and lots of other programs. The other kind of malicious feature is the backdoor. That means something in that program is listening for remote commands and obeying them, and those commands can mistreat the user. We know of backdoors in Windows, in the Iphone, in the Amazon b Swindleb. The Amazon b Swindleb has a backdoor that can remotely delete books. We know this by observation, because Amazon did it: in 2009 Amazon remotely deleted thousands of copies of a particular book. Those were authorized copies, people had obtain them directly from Amazon, and thus Amazon knew exactly where they were, which is how Amazon knew where to send the commands to delete those books. You know which book Amazon deleted? *1984* by Georges Orwell. Itbs a book everyone should read, because it discusses a totalitarian state that did things like delete books it didnbt like. Everybody should read it, but not on the Amazon b Swindleb. Anyway, malicious features are present in the most widely used non-free programs, but they are rare in free software, because with free software the users have control: they can read the source code and they can change it. So, if there were a malicious feature, somebody would sooner or later spot it and fix it. This means that somebody who is considering introducing a malicious feature does not find it so tempting, because he knows he might get away with it for a while but somebody will spot it, will fix it, and everybody will loose trust in the perpetrator. Itbs not so tempting when you know youbre going to fail. And thatbs why we find that malicious features are rare in free software, and common in proprietary software. [The 4 freedoms of free software] Now the essential freedoms are four: - freedom 0 is the freedom to run the program as you wish. - Freedom 1 is the freedom to study the source code and change it, so the program does your computing the way you wish. - Freedom 2 is the freedom to help others. Thatbs the freedom to make exact copies and redistribute them when you wish. - Freedom 3 is the freedom to contribute to your community. Thatbs the freedom to make copies of your modified versions, if you have made any, and then distribute them to others when you wish. These freedoms, in order to be adequate, must apply to all activities of life. For instance if it says: b This is free for academic use,b itbs not free. Because thatbs too limited. It doesnbt apply to all areas of life. In particular, if a program is free, that means it can be modified and distributed commercially, because commerce is an area of life, an activity in life. And this freedom has to apply to all activities. Now however, itbs not obligatory to do any of these things. The point is youbre free to do them if you wish, when you wish. But you never have to do them. You donbt have to do any of them. You donbt have to run the program. You donbt have to study or change the source code. You donbt have to make any copies. You donbt have to distribute your modified versions. The point is you should be free to do those things if you wish. Now, freedom number 1, the freedom to study and change the source code to make the program do your computing as you wish, includes something that might not be obvious at first. If the program comes in a product, and a developer can provide an upgrade that will run, then you have to be able to make your version run in that product. If the product would only run the developerbs versions, and refuses to run yours, the executable in that product is not free software. Even if it was compiled from free source code, itbs not free because you donbt have the freedom to make the program do your computing the way *you* wish. So, freedom 1 has to be real, not just theoretical. It has to include the freedom to use your version, not just the freedom to make some source code that wonbt run. [The GNU project and the free software movement] I launched the free software movement in 1983, when I announced the plan to develop a free software operating system whose name is GNU. Now GNU, the name GNU, is a joke; because part of the hackerbs spirit is to have fun even when youbre doing something very serious. Now I canbt think of anything more seriously important than defending freedom. But that didnbt mean I couldnbt give my system a name thatbs a joke. So GNU is a joke because itbs a recursive acronym, it stands for b GNU is Not Unixb, so G.N.U.: GNUbs Not Unix. So the G in GNU stands for GNU. Now in fact that was a tradition at the time. The tradition was: if there was an existing program and you wrote something similar to it, inspired by it, you could give credit by giving your program a name thatbs a recursive acronym saying itbs not the other one. So I gave credit to Unix for the technical ideas of Unix, but with the name GNU, because I decided to make GNU a Unix-like system, with the same commands, the same system calls, so that it would be compatible, so that people who used Unix can switch over easily. But the reason for developing GNU, that was unique. GNU is the only operating system, as far as I know, ever developed for the purpose of freedom. Not for technical motivations, not for commercial motivations. GNU was written for *your* freedom. Because without a free operating system, itbs impossible to have freedom and use a computer. And there were none, and I wanted people to have freedom, so it was up to me to write one. Nowadays there are millions of users of the GNU operating system and most of them donbt*know* they are using the GNU operating system, because there is a widespread practice which is not nice. People call the system b Linuxb. Many do, but some people donbt, and I hope youbll be one of them. Please, since we started this, since we wrote the biggest piece of the code, please give us equal mention, please call the system GNU+Linux, or GNU/Linux. Itbs not much to ask! But there is another reason to do this. It turns out that the person who wrote Linux, which is one component of the system as we use it today, doesnbt agree with the free software movement. And so if you call the whole system Linux, in effect youbre steering people towards his ideas, and away from our ideas. Because hebs not gonna say to them that they deserve freedom. Hebs going to say to them that he likes convenient, reliable, powerful software. Hebs going to tell people that those are the important values. But if you tell them the system is GNU+Linux b the GNU operating system plus Linux the kernel b then theybll know about us, and then they might listen to what *we* say. You deserve freedom, and since freedom will be lost if we donbt defend it b therebs always going to be a Sarkozy to take it away b we need above all to teach people to demand freedom, to be ready to stand up for their freedom the next time someone threatens to take it away. Nowadays, you can tell who doesbnt want to discuss these ideas of freedom because they donbt say b logiciel libreb. They donbt say b libreb, they say b open sourceb. That term was coined by the people like Mr Torvalds who would prefer that these ethical issues donbt get raised. And so the way you can help us raise them is by saying libre. You know, itbs up to you where you stand, youbre free to say what you think. If you agree with them, you can say open source. If you agree with us, show it: say libre! Free software and education Now the most important point about free software is that schools *must* teach exclusively free software. All levels of schools from kindergarten to university, itbs their *moral*responsibility to teach only free software in their education, and all other educational activities as well, including those that say that theybre spreading digital literacy. A lot of those activities teach Windows, which means theybre teaching *dependence*. To teach people the use proprietary software is to teach dependence, and educational activities must never do that because itbs the opposite of their mission. Educational activities have a social mission to educate good citizens of a strong, capable, cooperating, independent and free society. And in the area of computing, that means: teach free software. Never teach a proprietary program because thatbs inculcating dependence. Why do you think some proprietary developers offer gratis copies to schools? They want the schools to make the children dependent. And then, when they graduate, theybre still dependent and you know the company is not going to offer them gratis copies. And some of them get jobs and go to work for companies. Not many of them anymore, but some of them. And those companies are not going to be offered gratis copies. Oh no! The idea is if the school directs the students down the path of permanent dependence, they can drag the rest of society with them into dependence. Thatbs the plan! Itbs just like giving the school gratis needles full of addicting drugs, saying b inject this into your students, the first dose is gratis.b Once youbre dependent, then you have to pay. Well, the school would reject the drugs because it isnbt right to teach the students to use addictive drugs and itbs got to reject the proprietary software also. Some people say b letbs have the school teach both proprietary software and free software, so the students become familiar with both.b Thatbs like saying b for the lunch lets give the kids spinach and tabacco, so that they become accustomed to both.b No! The schools are only supposed to teach good habits, not bad ones! So there should be no Windows in a school, no Macintosh, nothing proprietary in the education. But also, for the sake of educating the programmers. You see, some people have a talent for programming. At ten to thirteen years old, typically, theybre fascinated, and if they use a program, they want to know b how does it do this?b But when they ask the teacher, if itbs proprietary, the teacher has to say b Ibm sorry, itbs a secret, we canbt find out.b Which means education is forbidden. A proprietary program is the enemy of the spirit of education. Itbs knowledge withheld, so it should not be tolerated in a school, even though there may be plenty of people in the school who donbt care about programming, donbt want to learn this. Still, because itbs the enemy of the spirit of education, it shouldnbt be there in the school. But if the program is free, the teacher can explain what he knows, and then give out copies of the source code, saying: b read it and youbll understand everything.b And those who are really fascinated, they will read it! And this gives them an opportunity to start to learn how to be good programmers. To learn to be a good programmer, youbll need to recognize that certain ways of writing code, even if they make sense to you and they are correct, theybre not good because other people will have trouble understanding them. Good code is clear code, that others will have an easy time working on when they need to make further changes. How do you learn to write good clear code? You do it by reading lots of code, and writing lots of code. And only free software offers the chance to *read* the code of large programs that we really use. And then you have to write lots of code, which means you have to write changes in large programs. How do you learn to write good code for the large programs? You have to start small, which does not mean small program, oh no! The challenges of the code for large programs donbt even begin to appear in small programs. So the way you start small at writing code for large programs is by writing small changes in large programs. And only free software gives you the chance to do that! So, if a school wants to offer the possibility of learning to be a good programmer, it needs to be a free software school. But there is an even deeper reason, and that is for the sake of moral education, education in citizenship. Itbs not enough for a school to teach facts and skills, it has to teach the spirit of goodwill, the habit of helping others. Therefore, every class should have this rule: b Students, if you bring software to class, you may not keep it for yourself, you must share copies with the rest of the class, including the source code in case anyone here wants to learn! Because this class is a place where we share our knowledge. Therefore, bringing a proprietary program to class is not permitted.b The school must follow its own rule to set a good example. Therefore, the school must bring only free software to class, and share copies, including the source code, with anyone in the class that wants copies. Those of you who have a connection with a school, itbs your duty to campaign and pressure that school to move to free software. And you have to be firm. It may take years, but you can succeed as long as you never give up. Keep seeking more allies among the students, the faculty, the staff, the parents, anyone! And always bring it up as an ethical issue. If someone else wants to sidetrack the discussion into this practical advantage and this practical disadvantage, which means theybre ignoring the most important question, then you have to say: b this is not about how to do the best job of educating, this is about how to do a good education instead of an evil one. Itbs how to do education right instead of wrong, not just how to make it a little more effective, or less.b So donbt get distracted with those secondary issues, and ignore what really matters! Internet services So, moving on to the next menace. There are two issues that arise from the use of internet services. One of them is that the server could abuse your data, and another is that it could take control of your computing. The first issue, people already know about. They are aware that, if you upload data to an internet service, there is a question of what it will do with that data. It might do things that mistreat you. What could it do? It could lose the data, it could change the data, it could refuse to let you get the data back. And it could also show the data to someone else you donbt want to show it to. Four different possible things. Now, here, Ibm talking about the data that you knowingly gave to that site. Of course, many of those services do *surveillance* as well. For instance, consider Facebook. Users send lots of data to Facebook, and one of the bad things about Facebook is that it shows a lot of that data to lots of other people, and even if it offers them a setting to say b no!b, that may not really work. After all, if you say b some other people can see this piece of information,b one of them might publish it. Now, thatbs not Facebookbs fault, there is nothing they could do to prevent that, but it ought to warn people. Instead of saying b mark this as only to your so-called friends,b it should say b keep in mind that your so-called friends are not really your friends, and if they want to make trouble for you, they could publish this.b Every time, it should say that, if they want to deal with people ethically. As well as all the data users of Facebook voluntarily give to Facebook, Facebook is collecting through data about peoplebs activities on the net through various methods of surveillance. But for now I am talking about the data that people *know* they are giving to these sites. Losing data is something that could always happen by accident. That possibility is always there, no matter how careful someone is. Therefore, you need to keep multiple copies of data that matters. If you do that, then, even if someone decided to delete your data intentionally, it wouldnbt hurt you that much, because youbd have other copies of it. So, as long as you are maintaining multiple copies, you donbt have to worry too much about someonebs losing your data. What about whether you can get it back. Well, some services make it possible to get back all the data that you sent, and some donbt. Google services will let the user get back the data the user has put into them. Facebook, famously, does not. Of course in the case of Google, this only applies to the data the user * knows* Google has. Google does lots of surveillance, too, and that data is not included. But in any case, if you can get the data back, then you could track whether they have altered it. And they are not very likely to start altering peoplebs data if the people can tell. So maybe we can keep a track on that particular kind of abuse. But the abuse of showing the data to someone you donbt want it to be shown to is very common and almost impossible for you to prevent, especially if itbs a US company. You see, the most hypocritically named law in US history, the so-called USA Patriot Act, says that Big Brotherbs police can collect just about all the data that companies maintain about individuals. Not just companies, but other organizations too, like public libraries. The police can get this massively, without even going to court. Now, in a country that was founded on an idea of freedom, there is nothing more unpatriotic than this. But this is what they did. So you mustnbt ever trust any of your data to a US company. And they say that foreign subsidiaries of US companies are subject to this as well, so the company you are directly dealing with may be in Europe, but if itbs owned by a US company, you got the same problem to deal with. However, this is mainly a concern when the data you are sending to the service is not for publication. There are some services where you publish things. Of course, if you publish something, you know everybody is gonna be able to see it. So, there is no way they can hurt you by showing it to somebody who wasnbt supposed to see it. There is nobody who wasnbt supposed to see it if you publish it. So in that case the problem doesnbt exist. So these are four sub-issues of this one threat of abusing our data. The idea of theFreedom Box project <https://www.freedomboxfoundation.org/> is you have your own server in your own home, and when you want to do something remotely, you do it with your own server, and the police have to get a court order in order to search your server. So you have the same rights this way that you would have traditionally in the physical world. The point here and in so many other issues is: as we start doing things digitally instead of physically, we shouldnbt lose any of our rights, because the general tendency is that we do lose rights. Basically, Stallmanbs law says that, in an epoch when governments work for the mega-corporations instead of reporting to their citizens, every technological change can be taken advantage of to reduce our freedom. Because reducing our freedom is what these governments want to do. So the question is: when do they get an opportunity? Well, any change that happens for some other reason is a possible opportunity, and they will take advantage of it if thatbs their general desire. But the other issue with internet services is that they can take control of your computing, and thatbs not so commonly known. But Itbs becoming more common. There are services that offer to do computing for you on data supplied by you b things that you should do on your own computer but they invite you to let somebody elsebs computer do that computing work for you. And the result is you lose control over it. Itbs just as if you used a non-free program. Two different scenarios but they lead to the same problem. If you do your computing with a non-free program b well, the users donbt control the non-free program, it controls the users, which would include you. So youbve lost control of the computing thatbs being done. But if you do your computing in his server b well, the programs that are doing it are the ones he chose. You canbt touch them or see them, so you have no control over them. He has control over them b maybe. If they are free software and he installs them, then he has control over them. But even he might not have control. He might be running a proprietary program in his server, in which case itbs somebody else who has control of the computing being done in his server. He doesnbt control it and you donbt. But suppose he installs a free program, then he has control over the computing being done in his computer, but you donbt. So, either way, you donbt! So the only way to have control over your computing is to do it with *your copy* of a free program. This practice is called B+ Software as a Service B;. It means doing your computing with your data in somebody elsebs server. And I donbt know of anything that can make this acceptable. Itbs always something that takes away your freedom, and the only solution I know of is to refuse. For instance, there are servers that will do translation or voice recognition, and you are letting them have control over this computing activity, which we shouldnbt ever do. Of course, we are also giving them data about ourselves which they shouldnbt have. Imagine if you had a conversation with somebody through a voice-recognition translation system that was Software as as Service and itbs really running on a server belonging to some company. That company also gets to know what was said in the conversation, and if itbs a US company that means Big Brother also gets to know. This is no good. The next threat to our freedom in a digital society is using computers for voting. You canbt trust computers for voting. Whoever controls the software in those computers has the power to commit undetectable fraud. Elections are special. Because therebs nobody involved that we dare trust fully. Everybody has to be checked, crosschecked by others, so that nobody is in the position to falsify the results by himself. Because if anybody is in a position to do that, he might do it! So our traditional systems for voting were designed so that nobody was fully trusted, everybody was being checked by others. So that nobody could easily commit fraud. But once you introduce a program, this is impossible! How can you tell if a voting machine would honestly count the votes? Youbd have to study the program thatbs running in it during the election, which of course nobody can do, and most people wouldnbt even know how to do. But even the experts who might theoretically be capable of studying the program, they canbt do it while people are voting. Theybd have to do it in advance, and then how do they know that the program they studied is the one thatbs running while pople vote? Maybe itbs been changed. Now, if this program is proprietary, that means some company controls it. The election authority canbt even tell what that program is doing. Well, this company then could rig the election. There are accusations that this was done in the US in the past ten years, that election results were falsified this way. But what if the program is free software? That means the election authority who owns this voting machine has control over the software in it, so the election authority could rig the election. You canbt trust them either. You donbt dare trust *anybody* in voting, and the reason is, therebs no way that the voters can verify for themselves that their votes were correctly counted, nor that false votes were not added. In other activities of life, you can usually tell if somebody is trying to cheat you. Consider for instance buying something from a store. You order something, maybe you give a credit card number. If the product doesnbt come, you can complain and you can b of course if you got a good enough memory you will b notice if that product doesnbt come. Youbre not just giving total blind trust to the store, because you can *check*. But in elections you canbt check. I saw once a paper where someone described a theoretical system for voting which uses some sophisticated mathematics so that people could check that their votes had been counted, even though everybodybs vote was secret, and they could also verify that false votes hadnbt been added. It was very exciting, powerful mathematics; but even if that mathematics is correct, that doesnbt mean the system would be acceptable to use in practice, because the vulnerabilities of a real system might be outside of that mathematics. For instance, suppose youbre voting over the Internet and suppose youbre using a machine thatbs a zombie. It might tell you that the vote was sent for A while actually sending a vote for B. Who knows whether youbd ever find out? In practice, the only way to see if these systems work and are honest is through years, in fact decades, of trying them and checking in other ways what happened. I wouldnbt want my country to be the pioneer in this. So, use paper for voting. Make sure there are ballots that can be recounted. The war on sharing The next threat to our freedom in a digital society comes from the war on sharing. One of the tremendous benefits of digital technology is that it is easy to copy published works and share these copies with others. Sharing is good, and with digital technology, sharing is easy. So, millions of people share. Those who profit by having power over the distribution of these works donbt want us to share. And since they are businesses, governments which have betrayed their people and work for the empire of mega-corporations try to serve those businesses, they are against their own people, they are for the businesses, for the publishers. Well, thatbs not good. And with the help of these governments, the companies have been waging *war* on sharing, and theybve proposed a series of cruel draconian measures. Why do they propose cruel draconian measures? Because nothing less has a chance of success: when something is good and easy, people do it. The only way to stop them is by being very nasty. So of course, what they propose is nasty, nasty, and the next one is nastier. So they tried suing teenagers for hundreds of thousands of dollars b that was pretty nasty. And they tried turning our technology against us, Digital Restrictions Management that means, digital handcuffs. But among the people there were clever programmers too and they found ways to break the handcuffs. For instance, DVDs were designed to have encrypted movies in a secret encryption format, and the idea was that all the programs to decrypt the video would be proprietary with digital handcuffs. They would all be designed to restrict the users. And their scheme worked okay for a while. But some people in Europe figured out the encryption and they released a free program that could actually play the video on a DVD. Well, the movie companies didnbt leave it there. They went to the US congress and bought a law making that software illegal. The United States invented censorship of software in 1998, with the Digital Millennium Copyright Act [DMCA]. So the distribution of that free program was forbidden in the United States. Unfortunately it didnbt stop with the United States. The European Union adopted a directive in 2003 requiring such laws. The directive only says that commercial distribution has to be banned, but just about every country in the European Union has adopted a nastier law. In France, the mere possession of a copy of that program is an offense punished by imprisonment, thanks to Sarkozy. I believe that was done by the law DADVSI. I guess he hoped that with an unpronounceable name, people wouldnbt be able to criticize it. So, elections are coming. Ask the candidates in the parties: will you repeal the DADVSI? And if not, donbt support them. You mustnbt give up lost moral territory forever. Youbve got to fight to win it back. So, we still are fighting against digital handcuffs. The Amazon b Swindleb has digital handcuffs to take away the traditional freedoms of readers to do things such as: give a book to someone else, or lend a book to someone else. Thatbs a vitally important social act. That is what builds society among people who read: lending books. Amazon doesnbt want to let people lend books freely. And then there is also selling a book, perhaps to a used bookstore. You canbt do that either. It looked for a while as if DRM had disappeared on music, but now theybre bringing it back with streaming services such as Spotify. These services all require proprietary client software, and the reason is so they can put digital handcuffs on the users. So, reject them! They already showed quite openly that you canbt trust them, because first they said: b you can listen as much as you like.b, and then they said: b Oh, no! You can only listen a certain number of hours a month.b The issue is not whether that particular change was good or bad, just or unjust; the point is, they have the power to impose any change in policies. So donbt let them have that power. You should have your own copy of any music you want to listen to. And then came the next assault on our freedom: HADOPI, basically punishment on accusation. It was started in France but itbs been exported to many other countries. The United States now demand such unjust policies in its free exploitation treaties. A few months ago, Columbia adopted such a law under orders from its masters in Washington. Of course, the ones in Washington are not the real masters, theybre just the ones who control the United States on behalf of the Empire. But theybre the ones who also dictate to Columbia on behalf of the Empire. In France, since the Constitutional Council objected to explicity giving people punishment without trial, they invented a kind of trial which is not a real trial, which is just a form of a trial, so they can *pretend* that people have a trial before theybre punished. But in other countries they donbt bother with that, itbs explicit punishment on accusation only. Which means that for the sake of their war on sharing, theybre prepared to abolish the basic principles of justice. It shows how thoroughly anti-freedom anti-justice they are. These are not legitimate governments. And Ibm sure theybll come up with more nasty ideas because theybre paid to defeat the people no matter what it takes. Now, when they do this, they always say that itbs for the sake of the artists, that they have b protectb the b creators.b Now those are both propaganda terms. I bm convinced that the reason they love the word b creatorsb is because it is a comparison with a deity. They want us to think of artists as super-human, and thus deserving special privileges and power over us, which is something I disagree with. In fact , the only artists that benefit very much from this system are the big stars. The other artists are getting crushed into the ground by the heels of these same companies. But they treat the stars very well, because the stars have a lot of clout. If a star threatens to move to another company, the company says: b oh, webll give you what you want.b But for any other artist they say: b you donbt matter, we can treat you any way we like.b So the superstars have been corrupted by the millions of dollars or euros that they get, to the point where theybll do almost anything for more money. For instance, J. K. Rowling is a good example. J. K. Rowling, a few years ago, went to court in Canada and obtained an order that people who had bought her books must not read them. She got an order telling people not to read her books. Herebs what happened. A bookstore put the books on display for sale too early, before the day they were supposed to go on sale. And people came into the store and said: b oh, I want that!b and they bought it and took away their copies. Then, they discovered the mistake and took the copies off of display. But Rowling wanted to crush any circulation of any information from those books, so she went to court, and the court ordered those people not to read the books that they now owned. In response, I call for a total boycott of Harry Potter. But I donbt say you shouldnbt read those books or watch the movies, I only say you shouldnbt buy the books or pay for the movies. I leave it to Rowling to tell people not to read the books. As far as Ibm concerned, if you borrow the book and read it, thatbs okay. Just donbt give her any money! But this happened with paper books. The court could make this order but it couldnbt get the books back from the people who had bought them. Imagine if they were ebooks. Imagine if they were ebooks on the b Swindleb. Amazon could send commands to erase them. So, I donbt have much respect for stars who will go to such lengths for more money. But most artists arenbt like that, they never got enough money to be corrupted. Because the current system of copyright supports most artists very badly. And so, when these companies demand to expand the war on sharing, supposedly for the sake of the artists, Ibm against what they want but I would like to support the artists better. I appreciate their work and I realize if we want them to do more work we should support them. [Supporting the arts] I have two proposals for how to support artists, methods that are compatible with sharing. That would allow us to end the war on sharing and still support artists. One method uses tax money. We get a certain amount of public funds to distribute among artists. But, how much should each artist get? We have to measure popularity. The current system supposedly supports artists based on their popularity. So Ibm saying letbs keep that, letbs continue on this system based on popularity. We can measure the popularity of all the artists with some kind of polling or sampling, so that we donbt have to do surveillance. We can respect peoplebs anonymity. We get a raw popularity figure for each artist, how do we convert that into an amount of money? The obvious way is: distribute the money in proportion to popularity. So if A is a thousand times as popular as B, A will get a thousand times as much money as B. Thatbs not efficient distribution of the money. Itbs not putting the money to good use. Itbs easy for a star A to be a thousand times as popular as a fairly successful artist B. If we use linear proportion, webll give A a thousand times as much money as we give B. And that means that, either we have to make A tremendously rich, or we are not supporting B enough. The money we use to make A tremendously rich is failing to do an effective job of supporting the arts; so, itbs inefficient. Therefore I say: letbs use the cube root. Cube root looks sort of like this. The point is: if A is a thousand times as popular as B, with the cube root A will get ten times as much as B, not a thousand times as much, just ten times as much. The use of the cube root shifts a lot of the money from the stars to the artists of moderate popularity. And that means, with less money we can adequately support a much larger number of artists. There are two reasons why this system would use less money than we pay now. First of all because it would be supporting artists but not companies, second because it would shift the money from the stars to the artists of moderate popularity. Now, it would remain the case that the more popular you are, the more money you get. So the star A would still get more than B, but not astronomically more. Thatbs one method, and because it wonbt be so much money it doesnbt matter so much how we get the money. It could be from a special tax on Internet connectivity, it could just be some of the general budget that gets allocated to this purpose. We wonbt care because it wonbt be so much money; much less than webre paying now. The other method Ibve proposed is voluntary payments. Suppose each player had a button you could use to send one euro. A lot of people would send it, after all itbs not that much money. I think a lot of you might push that button every day, to give one euro to some artist who had made a work that you liked. But nothing would demand this, you wouldnbt be required or ordered or pressured to send the money; you would do it because you felt like it. But there are some people who wouldnbt do it because theybre poor and they canbt afford to give one euro. And itbs good that they wonbt give it, we donbt have to squeeze money out of poor people to support the artists. There are enough non poor people whobll be happy to do it. Why wouldnbt you give one euro to some artists today, if you appreciated their work? Itbs too inconvenient to give it to them. So my proposal is to remove the inconvenience. If the only reason not to give that euro is [that ] you would have one euro less, you would do it fairly often. So these are my two proposals for how to support artists, while encouraging sharing because sharing is good. Letbs put an end to the war on sharing, laws like DADVSI and HADOPI, itbs not just the methods that they propose that are evil, their purpose is evil. Thatbs why they propose cruel and draconian measures. Theybre trying to do something thatbs nasty by nature. So letbs support artists in other ways. [Rights in cyberspace] The last threat to our freedom in digital society is the fact that we donbt have a firm right to do the things we do, in cyberspace. In the physical world, if you have certain views and you want to give people copies of a text that defends those views, youbre free to do so. You could even buy a printer to print them, and youbre free to hand them out on the street, or youbre free to rent a store and hand them out there. If you want to collect money to support your cause, you can just have a can and people could put money into the can. You donbt need to get somebody elsebs approval or cooperation to do these things. But, in the Internet, you do need that. For instance if want to distribute a text on the Internet, you need companies to help you do it. You canbt do it by yourself. So if you want to have a website, you need the support of an ISP or a hosting company, and you need a domain name registrar. You need them to continue to let you do what youbre doing. So youbre doing it effectively on sufferance, not by right. And if you want to receive money, you canbt just hold out a can. You need the cooperation of a payment company. And we saw that this makes all of our digital activities vulnerable to suppression. We learned this when the United States government launched a b distributed denial of service attackb [ DDoS <http://fr.wikipedia.org/wiki/Attaque_par_d%C3%A9ni_de_service>] against WikiLeaks. Now Ibm making a bit of joke because the words b distributed denial of service attackb usually refer to a different kind of attack. But they fit perfectly with what the United States did. The United States went to the various kinds of network services that WikiLeaks depended on, and told them to cut off service to WikiLeaks. And they did. For instance, WikiLeaks had rented a virtual Amazon server, and the US government told Amazon: b cut off service for WikiLeaks.b And it did, arbitrarily. And then, Amazon had certain domain names such as as wikileaks.org, the US government tried to get all those domains shut off. But it didnbt succeed, some of them were outside its control and were not shut off. Then, there were the payment companies. The US went to PayPal, and said: b Stop transferring money to WikiLeaks or webll make life difficult for you.b And PayPal shut off payments to WikiLeaks. And then it went to Visa and Mastercard and got them to shut off payments to WikiLeaks. Others started collecting money on WikiLeaks behalf and their account were shut off too. But in this case, maybe something can be done. Therebs a company in Iceland which began collecting money on behalf of WikiLeaks, and so Visa and Mastercard shut off its account; it couldnbt receive money from its customers either. Now, that business is suing Visa and Mastercard apparently, under European Union law, because Visa and Mastercard together have a near-monopoly. Theybre not allowed to arbitrarily deny service to anyone. Well, this is an example of how things need to be for all kinds of services that we use in the Internet. If you rented a store to hand out statements of what you think, or any other kind of information that you can lawfully distribute, the landlord couldnbt kick you out just because he didnbt like what you were saying. As long as you keep paying the rent, you have the right to continue in that store for a certain agreed-on period of time that you signed. So you have some rights that you can enforce. And they couldnbt shut off your telephone line because the phone company doesnbt like what you said or because some powerful entity didnbt like what you said and threatened the phone company. No! As long as you pay the bills and obey certain basic rules, they canbt shut off your phone line. This is what itbs like to have some rights! Well, if we move our activities from the physical world to the virtual world, then either we have the same rights in the virtual world, or we have been harmed. So, the precarity of all our Internet activities is the last of the menaces I wanted to mention. Now Ibd like to say that for more information about free software, look at GNU.org <http://www.gnu.org/>. Also look at fsf.org <http://www.fsf.org/>, which is the website of the Free Software Foundation. You can go there and find many ways you can help us, for instance. You can also become a member of the Free Software Foundation through that site. [b&] There is also the Free Software Foundation of Europe fsfe.org <http://www.fsfe.org/>. You can join FSF Europe also. [b&] [Auction of an b adorable GNU.b Highest bid was b,420!] ------------------------------ This transcription was done <http://etherpad.fsfe.org/Mh8Fateg0a> by: Loki, ThC)rC(se, duthils, regisrob, mrMuggles, Moonwalker, Hugo b&and 1 unnamed author. A *big thanks* to them! The transcription of Richard Stallmanbs lecture, as well as the video, are licensed under the CreativeCommons-Attribution-NonDerivative 3.0 license <http://creativecommons.org/licenses/by-nd/3.0/>. _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [tor-talk] How close to really secure Android phone with Tor and crypto?
by Julian Yon 06 Jul '18

06 Jul '18

On Fri, 16 Nov 2012 14:59:26 +0100 Jerzy Eogiewa <jerzyma(a)interia.eu> wrote: > About transparent encrypted call: > > I would like to make call with normal phone app, and make some > detection of encrypted support, with automatic switching to > crypto-call if working. This is how some Mac app like Adium work with > OTR. It seems possible, some short sound modulated-audio "handshake" > at start? > > Is this ideas reality or dream? :-) You may wish to look up Zfone/ZRTP. -- 3072D/F3A66B3A Julian Yon (2012 General Use) <pgp.2012(a)jry.me> _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] Iron Dome
by Gregory Foster 06 Jul '18

06 Jul '18

DefenseNews (Nov 25) - "Israel Tests 'Brains, Not Brawn' Gaza Strategy ": http://www.defensenews.com/article/20121125/DEFREG04/311250010/Israel-Tests… > More than 1,500 rockets were launched from the Gaza Strip during the > fighting, 875 of which landed in open areas. Of the 573 rockets > designated by Israelbs Iron Dome system as threats to life or property, > there were 421 interceptions, a success rate of about 85 percent. I read that as indicating something about the autonomy of the Iron Dome system. It looks like ICRAC had already inquired: http://www.newscientist.com/article/dn22518-iron-dome-rocket-smasher-set-to… via @DangerRoom and @JSchanzer http://twitter.com/dangerroom/status/272857376594468864 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Concept: Mobile proxies for downloading pdfs
by Bryan Bishop 06 Jul '18

06 Jul '18

Here's a basic concept for using mobile proxies. The idea is that college students would install an android or iphone app that would phone home and tell a server that a phone is now available to take requests. The app would travel over HTTP (to prevent any sort of port blocks) and ask the server for any new papers to download. The app would perform the download, then POST or PUT the file back to the server along with the metadata. The metadata could be served back to the server by POSTing the HTML, actually. Components: 1) android app 2) iphone app 3) a common protocol, probably JSON over HTTP 4) a central server to send requests 5) some way to access this server to manage a fleet or get back pdfs. Any thoughts on how to make this work out? I can write the android and iphone versions for this, and the server, but it would be better if there were others involved. Additionally, I have been having trouble finding an appropriate proxy to run on android that isn't limited to HTTP requests.. surely there's some sort of botnet-provided proxy on android already ? Transproxy isn't it, and proxydroid is really just for redirecting outgoing requests, not handling incoming requests from other machines. - Bryan http://heybryan.org/ 1 512 203 0507 -- You received this message because you are subscribed to the Google Groups "science-liberation-front" group. To unsubscribe from this group, send email to science-liberation-front+unsubscribe(a)googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: Why we don't use digital cash
by Declan McCullagh 06 Jul '18

06 Jul '18

[Digital cash inventor David Chaum filed for his first patent in this area on June 25, 1982. The suite begins to expire in 2002, with an important patent expiring in 2005. Seems as though we'll have to wait 'til then to see truly anonymous digital cash. For now, we're stuck with PayPal and credit cards. Sigh. --Declan] --- http://www.wired.com/news/ebiz/0,1272,44507,00.html Digging Those Digicash Blues By Declan McCullagh (declan(a)wired.com) 2:00 a.m. June 14, 2001 PDT BALTIMORE -- For the last six years, Robert Hettinga has been agitating, begging and pleading for the world to listen to his ambitious plans for digital money. Like any savvy techno-evangelist, Hettinga coined a name for his idea -- digital bearer certificates -- and envisions a day when Internet users can withdraw electronic cash by simply typing in an ATM card number and their PIN. To bolster his campaign, Hettinga launched the Digital Commerce Society of Boston, co-founded the Financial Cryptography conference, and has become a fixture on mailing lists devoted to cryptography and security. DCSB has even birthed offspring: On Tuesday, Hettinga came to Baltimore to speak at the inaugural meeting of a new sister chapter. But six years, five Financial Cryptography conferences and thousands of e-mail missives later, Hettinga has been almost entirely unsuccessful in attracting serious interest in his ideas. His two-year-old Internet Bearer Underwriting Corporation missed the ready capital of the online boom. It has attracted only $160,000 in funding, and has done about $100,000 of consulting work so far. "Quite frankly, the dot-com money has gone away," says Hettinga, 42. "We're also running over ground that CyberCash, DigiCash and a lot of other people have burned." Incinerated would be closer to the truth. The electronic cash landscape is littered with the looted corpses of companies that tried and failed to compete with credit cards for online purchases. True digital cash that's as anonymous, as privacy-protected and as cheap as the humble greenback seems to be one of those technologies that pundits laud and technologists adore, but markets stubbornly fail to adopt. [...] ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe, visit http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

GOA kicks ass, calls names, threatens prison. List headed by
by Somebody in Anguilla 06 Jul '18

06 Jul '18

AFSA and AHTA List includes AFSA, AHTA, Astaphan, JB, Cora Hodge, Abel, Pastor Philip, Rizzuto, First Caribbean, Uncle Kennet, Keithley Lake, Lime, Claudel, Hauser, Bevington, Optimist Club, Adventists, Pump House, UWI and Kennedy Gleefully published by "Dr" Vernal Bryan: http://www.anguillalife.com/news/stories/local/12275.php ABS 2008 - Listed Businesses are asked to contact the Anguilla Statistics Department Date Posted: May 26, 2009 Anguilla National Accounts and Balance of Payments - FINAL REMINDER (Press Release - Anguilla Statistics Department) - The Anguilla Statistics Department has reviewed its files of returns for the Annual Business Survey and even though the deadline for returning the questionnaire has passed, a vast majority of businesses still have not returned their questionnaires. In December 2008 the Department distributed via mail the Annual Business Survey questionnaire(s) to all businesses on our record as at September 2008. It is imperative that the data is received by the Department before Friday, May 22, 2009, as the data is integral for the calculation of the 2008 National Accounts and Balance of Payments figures for Anguilla. Our records seem to indicate that a number of businesses, such as, not for profit organisations, sport clubs, restaurants, hotels and other organisations have yet to return the questionnaire completed as accurately as possible. To this end, we are requesting that the owner/manager of the following businesses contact the Statistics Department today to regularise the status of his/her business return(s). Owners/Managers are also requested to check their files and ensure that the requisite business questionnaire(s) have been returned. 18 Degrees North Altamer Resort Anguilla Caribbean Lottery Anguilla Civil Service Association Anguilla Family Planning Association Anguilla Financial Service Association Anguilla Football Association Anguilla Great House Anguilla Hotel & Tourism Association Anguilla Mortgage Company Ltd. Anguilla Red Cross Anguilla Rums Ltd. Anguilla Shores Anguilla Tennis Academy Apex Auto Supplies Aronel Ltd Ashleys and Sons Astaphan's Chambers Bananas by the Sea Benjamine Company Services Bevis Trucking Boo's Car & Cycle Rentals C.R. Hodge & Associates Carib Trans Caribbean Associated Attorneys Caribbean Cable Communications (Anguilla), Ltd Caribbean Juris Chambers Church Of God (Holiness) Preschool Ciao Pizza Collen Clothings & Home Fashion Connies Home Centre Coyaba Manor Cuisinart Resort & Spa D-3 Enterprises Ltd./Royal Sun Alliance & Atlantic Delta Petroleum Anguilla Ltd Diamonds International Limited Digicel Easy Corner Villas Ellie's Music/Record Shop Elodias Beach Resort English Rose First Caribbean International Bank Foods Ninety Five Four Star (Amerijet) Gorgeous Scilly Cay Harney Westwood & Riegels Services (Anguilla) Ltd Isaura Villas Island Car Rental Island Construction J.T.C Customs Brokerage & Shipping Agents KCW et al Keene Enterprises Keesha Fleming Law Office Keithley F. Lake & Associates Kerwin Kottages KPMG Kwik Kopy Le Petit Patissier Koal Keel Co. Ltd. Leon's Tailoring & Dressmaking Light House Restaurant LIME Anguilla Lloyd's Aviation Services Madeariman Reef Mag's Cake Dicor Baking Supplies Mala's Cottage Max Printing Service Mediterraneo National Trucking & Heavy Equipment Optimist Club of Anguilla Paradise Cove Resort Professional Corporate Services, Ltd Professional Digital Services Ltd Rich One Rental & Sales Roadwell Cafi Roy's Bayside Grill Seventh-Day Adventist Church Simply Natural by Yinka Something Special Limited Spyglass Hill Villa Tasty's Restaurant TE Wade Construction & Architectural Design The Overlook Restaurant The Pumphouse The Purple Rose Florist Tri-Us Inc Tropical Distributors Co. Ltd. Tropical Flower Ltd U.W.I. Distance Education Centre Ultimate Dvd's Plus Veya Restaurant Vinca Plumbing Co.Ltd Weblinks Ltd. Zara's Seafood Restaurant Businesses are required by law, to complete this questionnaire and upon completion the data supplied to the Department becomes confidential. The protection of the collected data is legislated and guaranteed, under the Statistics Act of Anguilla. Additionally under Section 19 of the Statistics Act of Anguilla, any person guilty of an offence against this Act or any regulation made thereunder for which no special punishment is provided is liable on summary conviction to a fine of $3,000, and in default of payment to imprisonment for a period of 6 months, and in the case of a continuing offence to a further fine of $100 for each day on which the offence continues after conviction. We are kindly and finally requesting that the completed form(s) be returned to the Statistics Department by Friday, 22nd May 2009 by mail in the self-addressed envelope enclosed, fax or e-mail media (please request an electronic version). Failing this the Statistics Department would be left with no choice but to seek the assistance of the Attorney Generals Chambers. Should anyone have any questions or difficulties when completing the questionnaire please do not hesitate to contact us for assistance at telephone number 497-2451 Ext 2874 or 497-5731. We would like to take this opportunity to thank persons in advance for taking the time to provide the requested information. The Anguilla Statistics Department would like to take this opportunity to thank all those businesses that have already returned their questionnaires. -----BEGIN PGP SIGNATURE----- Version: 9.10.0.500 wsBVAwUBSh1DJ8UCGwxmWcHhAQEh1Af/ZXoktUX8wlwGBUEKbKa4Y/DA72l/4jOl WTh4atcJA+uDF30bdysQeP6khay0KZmyjG9APEIShcz4FyGhdg6IgOR4CFw4mN9f 7Q//EL2a0MuqaUcpXbhZlvVXXvcgI8UvS+7JmdrDCsUKzRs43Xz1RHfmhcC84+kL Ex3vF1jS5mf81sT/P6/+Uj9KhDv3eAZ6BZ2jd5dr75+tOn7IgCtMiLlu/xQu/2w6 B16bUg4Z2rMQspxtehQ1PgagKVqREgl1+aw0aSnWz4jFzsioD6fGxHquAax7NFyh V8Y3K1cQ1eRF0l8CBJHU+XWoNH6+Ce0Z2fQvkc0Ce5HsRlK8hz8+eA== =qg14 -----END PGP SIGNATURE-----

1 0

[p2p-hackers] Call for Participation: The 12th Information Security Conference (ISC 2009)
by Eros Pedrini 06 Jul '18

06 Jul '18

[Apologies if you receive multiple copies of this message] CALL FOR PARTICIPATION *********************************************************************** 12th Information Security Conference (ISC 2009) Pisa, Italy -- September 7-9, 2009 http://isc09.dti.unimi.it *********************************************************************** ABOUT THE CONFERENCE ISC is an annual international conference covering research in and applications of information security. The twelfth Information Security Conference (ISC 2009) will be held in Pisa, Italy. The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of information security. The conference will be a 3-day event featuring technical presentations of 29 full papers and 9 short papers and two invited talks. The twelfth Information Security Conference (ISC 2009) will be held in Pisa, Italy. REGISTRATION Registration information is available at http://isc09.dti.unimi.it/registration PROGRAM * Monday, September 7, 2009 9:00 - 9:30 Opening 9:30 - 10:30 Keynote speaker: Prof. Sushil Jajodia 10:30 - 11:00 Coffee break 11:00 - 13:00 Session 1: Analysis techniques A New Approach to chi^2 Cryptanalysis of Block Ciphers Jorge Nakahara Jr, Gautham Sekar, Daniel Santana de Freitas, Chang Chiann, Ramon Hugo de Souza, and Bart Preneel Analysis and Optimization of Cryptographically Generated Addresses Joppe W. Bos, Onur Ozen, and Jean-Pierre Hubaux Security Analysis of the PACE Key-Agreement Protocol Jens Bender, Marc Fischlin, and Dennis Kugler Towards Security Notions for White-Box Cryptography (Short Paper) Amitabh Saxena, Brecht Wyseur, and Bart Preneel A calculus to detect guessing attacks (Short Paper) Bogdan Groza and Marius Minea 13:00 - 14:15 Lunch 14:15 - 15:45 Session 2: Hash functions Structural Attacks on Two SHA-3 Candidates: Blender-n and DCH-n Mario Lamberger and Florian Mendel Meet-in-the-Middle Attacks Using Output Truncation in 3-Pass HAVAL Yu Sasaki On Free-Start Collisions and Collisions for TIB3 Florian Mendel and Martin Schlaffer 15:45 - 16:15 Coffee break 16:15 - 17:45 Session 3: Database security and biometrics Detection of Database Intrusion using a Two-Stage Fuzzy System Suvasini Panigrahi, Shamik Sural Combining Consistency and Confidentiality Requirements in First-Order Databases Joachim Biskup and Lena Wiese Cancelable Iris Biometrics using Block Re-mapping and Image Warping (Short Paper) Jutta Hammerle-Uhl, Elias Pschernig, and Andreas Uhl Iris Recognition in Nonideal Situations (Short Paper) Kaushik Roy and Prabir Bhattacharya * Tuesday, September 8, 2009 09:00 - 10:30 Session 4: Algebraic attacks and proxy re-encryption Efficient Conditional Proxy Re-Encryption with Chosen-Ciphertext Security Jian Weng, Yanjiang Yang, Qiang Tang, Robert H. Deng, and Feng Bao Practical Algebraic Attacks on the Hitag2 Stream Cipher Nicolas T. Courtois, Sean ObNeil, and Jean-Jacques Quisquater A New Construction of Boolean Functions with Maximum Algebraic Immunity Deshuai Dong, Shaojing Fu, Longjiang Qu, and Chao Li 10:30 - 11:00 Coffee break 11:00 - 13:00 Session 5: Distributed system security A2M: Access-Assured Mobile Desktop Computing Angelos Stavrou, Ricardo A. Barrato, Angelos D. Keromytis, and Jason Nieh Automated Spyware Collection and Analysis Andreas Stamminger, Christopher Kruegel, Giovanni Vigna, and Engin Kirda Towards Unifying Vulnerability Information for Attack Graph Construction Sebastian Roschke, Feng Cheng, Robert Schuppenies, and Christoph Meinel Traitor Tracing without a Priori Bound on the Coalition Size (Short Paper) Hongxia Jin and Serdar Pehlivanoglu SISR - a New Model for Epidemic Spreading of Electronic Threats (Short Paper) Boris Rozenberg, Ehud Gudes, and Yuval Elovici 13:00 - 14:15 Lunch 14:15 - 15:45 Session 6: Identity management and authentication An Efficient Distance Bounding RFID Authentication Protocol: Balancing False-Acceptance Rate and Memory Requirement Gildas Avoine and Aslan Tchamkerten Robust Authentication Using Physically Unclonable Functions Keith B. Frikken, Marina Blanton, and Mikhail J. Atallah Risks of the CardSpace Protocol Sebastian Gajek, Jorg Schwenk, Michael Steiner, and Chen Xuan 15:45 - 16:15 Coffee break 16:15 - 18:00 Session 7: Applied cryptography Fair E-cash: Be Compact, Spend Faster Sebastien Canard, Cecile Delerablee, Aline Gouget, Emeline Hufschmitt, Fabien Laguillaumie, Herve Sibert, Jacques Traore, and Damien Vergnaud On the security of Identity Based Ring Signcryption Schemes S. Sharmila Deva Selvi, S. Sree Vivek, and C. Pandu Rangan A Storage Efficient Redactable Signature in the Standard Model Ryo Nojima, Jin Tamura, Youki Kadobayashi, and Hiroaki Kikuchi Generic Construction of Stateful Identity Based Encryption (Short Paper) Peng Yang, Rui Zhang, Kanta Matsuura, and Hideki Imai * Wednesday, September 9, 2009 09:30 - 10:30 Keynote speaker: Prof. Jan Camenisch 10:30 - 11:00 Coffee break 11:00 - 13:00 Session 8: Access control Privacy-aware Attribute-based Encryption with User Accountability Jin Li, Kui Ren, Bo Zhu, and Zhiguo Wan Hardware-Assisted Application-Level Access Control Yu-Yuan Chen and Ruby B. Lee Towards Trustworthy Delegation in Role-Based Access Control Model Manachai Toahchoodee, Xing Xie, and Indrakshi Ray Secure Interoperation in Multidomain Environments Employing UCON Policies (Short Paper) Jianfeng Lu, Ruixuan Li, Vijay Varadharajan, Zhengding Lu, and Xiaopu Ma Specification and Enforcement of Static Separation-of-Duty Policies in Usage Control (Short Paper) Jianfeng Lu, Ruixuan Li, Zhengding Lu, Jinwei Hu, and Xiaopu Ma 13:00 - 14:15 Lunch 14:15 - 15:45 Session 9: MAC and nonces Nonce Generators and the Nonce Reset Problem Erik Zenner MAC Precomputation with Applications to Secure Memory Juan Garay, Vladimir Kolesnikov, and Rae McLellan HMAC without the b Secondb Key Kan Yasuda 15:45 - 16:15 Coffee Break 16:15 - 17:45 Session 10: P2P and web services Adding Trust to P2P Distribution of Paid Content Alex Sherman, Angelos Stavrou, Jason Nieh, Angelos D. Keromytis, and Cliff Stein Peer-to-peer Architecture for Collaborative Intrusion and Malware Detection on a Large Scale Mirco Marchetti, Michele Messori, and Michele Colajanni F3ildCrypt: End-to-End Protection of Sensitive Information in Web Services Matthew Burnside and Angelos D. Keromytis MORE INFORMATION Additional information about the conference can be found at http://isc09.dti.unimi.it/ _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Threats to anonymity set at and above the application layer; HTTP
by Seth David Schoen 06 Jul '18

06 Jul '18

headers User-Agent: Mutt/1.5.11 Reply-To: or-talk(a)freehaven.net It's pretty well understood that anonymity can be lost at higher protocol layers even when it's well protected at lower layers. One eye-opening paper on this point is "Can Pseudonymity Really Guarantee Privacy?" by Rao and Rohatgi (in the Freehaven Anonymity Bibliography): http://www.usenix.org/publications/library/proceedings/sec2000/full_papers/… o/rao.pdf This is a philosophically interesting problem; it prompts the question "if pseudonymity can't guarantee privacy, what _can_?". (Rao and Rohatgi remind us that the authors of the Federalist Papers used pseudonyms and were still identified solely from the evidence of their writing.) There is also the scary field of timing attacks on users' typing: http://www.cs.berkeley.edu/~daw/papers/ssh-use01.pdf http://www.cs.berkeley.edu/~tygar/papers/Keyboard_Acoustic_Emanations_Revis… ed/ccs.pdf (The Tygar paper is not really relevant for network surveillance, but it shows the scariness of statistical methods for figuring out what users are doing based on seemingly irrelevant information.) In a sense, there are many privacy-threatening features in and above the application layer (some of them depending on the nature and latency of a communication): * timing of access (what time zone are you in, when do you usually do something?) -- for communications with non-randomized latency < 1 day * typing patterns (cf. Cliff Stoll's _Cuckoo's Egg_ and the Song et al. paper) * typing speed * language comprehension and selection * language proficiency * idiosyncratic language use * idiosyncratic language errors (cf. Rao and Rohatgi) * cookies and their equivalents (cf. Martin Pool's "meantime", a cookie equivalent using client-side information that was intended for a totally different purpose -- cache control) * unique browser or other application headers or behavior (distinguishing MSIE from Firefox from Opera? not just based on User-agent but based on request patterns, e.g. for inline images, and different interpretations of HTTP standards and perhaps CSS and JavaScript standards) * different user-agent versions (including leaked information about the platform) * different privoxy versions and configurations I'm not sure what to do to mitigate these things. The Rao paper alone strongly suggests that providing privacy up to the application layer will not always make communications unlinkable (and then there is the problem of insulating what pseudonymous personae are supposed to know about or not know about, and the likelihood of correlations between things they mention). These problems are alluded to in on the Tor web site: Tor can't solve all anonymity problems. It focuses only on protecting the transport of data. You need to use protocol-specific support software if you don't want the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy while web browsing to block cookies and withhold information about your browser type. Also, to protect your anonymity, be smart. Don't provide your name or other revealing information in web forms. Be aware that, like all anonymizing networks that are fast enough for web browsing, Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit. However, the recommendation to use Privoxy, by itself, is far from solving the problem of correlations between user and user sessions. I think a low-hanging target is the uniqueness of HTTP headers sent by particular users of HTTP and HTTPS over Tor. Accept-Language, User-Agent, and a few browser-specific features are likely to reveal locale and OS and browser version -- sometimes relatively uniquely, as when someone uses a Linux distribution that ships with a highly specific build of Firefox -- and this combination may serve to make people linkable or distinguishable in particular contexts. Privoxy does _not_, depending on its configuration, necessarily remove or rewrite all of the potentially relevant HTTP protocol headers. Worse, different Privoxy configurations may actually introduce _new_ headers or behaviors that further serve to differentiate users from one another. One example is that some Privoxy configurations insert headers specifically identifying the user as a Privoxy user and taunting the server operator; but if some users do this and other users don't, the anonymity set is chopped up into lots of little bitty anonymity sets. For instance: +add-header{X-User-Tracking: sucks} User tracking does suck, but adding an optional header saying so has the obvious effect of splitting the anonymity set in some circumstances into people who send the X-User-Tracking: sucks header and people who don't. Any variation in practice here is potentially bad for the size of the anonymity set. A remedy for this would be to try to create a standardized Privoxy configuration and set of browser headers, and then try to convince as many Tor users as possible to use that particular configuration. (One way to do this is to try to convince everyone who makes a Tor+Privoxy distribution or product to use the agreed-upon default configuration.) The goal is not to prevent people from controlling their own Privoxy configurations or doing more things to protect their privacy; rather, it is to try to reduce the variety in headers and behaviors seen by web servers contacted by Tor users on different platforms. -- Seth Schoen Staff Technologist schoen(a)eff.org Electronic Frontier Foundation http://www.eff.org/ 454 Shotwell Street, San Francisco, CA 94110 1 415 436 9333 x107 ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

GOA kicks ass, calls names, threatens prison. List headed by
by Somebody in Anguilla 06 Jul '18

06 Jul '18

AFSA and AHTA List includes AFSA, AHTA, Astaphan, JB, Cora Hodge, Abel, Pastor Philip, Rizzuto, First Caribbean, Uncle Kennet, Keithley Lake, Lime, Claudel, Hauser, Bevington, Optimist Club, Adventists, Pump House, UWI and Kennedy Gleefully published by "Dr" Vernal Bryan: http://www.anguillalife.com/news/stories/local/12275.php ABS 2008 - Listed Businesses are asked to contact the Anguilla Statistics Department Date Posted: May 26, 2009 Anguilla National Accounts and Balance of Payments - FINAL REMINDER (Press Release - Anguilla Statistics Department) - The Anguilla Statistics Department has reviewed its files of returns for the Annual Business Survey and even though the deadline for returning the questionnaire has passed, a vast majority of businesses still have not returned their questionnaires. In December 2008 the Department distributed via mail the Annual Business Survey questionnaire(s) to all businesses on our record as at September 2008. It is imperative that the data is received by the Department before Friday, May 22, 2009, as the data is integral for the calculation of the 2008 National Accounts and Balance of Payments figures for Anguilla. Our records seem to indicate that a number of businesses, such as, not for profit organisations, sport clubs, restaurants, hotels and other organisations have yet to return the questionnaire completed as accurately as possible. To this end, we are requesting that the owner/manager of the following businesses contact the Statistics Department today to regularise the status of his/her business return(s). Owners/Managers are also requested to check their files and ensure that the requisite business questionnaire(s) have been returned. 18 Degrees North Altamer Resort Anguilla Caribbean Lottery Anguilla Civil Service Association Anguilla Family Planning Association Anguilla Financial Service Association Anguilla Football Association Anguilla Great House Anguilla Hotel & Tourism Association Anguilla Mortgage Company Ltd. Anguilla Red Cross Anguilla Rums Ltd. Anguilla Shores Anguilla Tennis Academy Apex Auto Supplies Aronel Ltd Ashleys and Sons Astaphan's Chambers Bananas by the Sea Benjamine Company Services Bevis Trucking Boo's Car & Cycle Rentals C.R. Hodge & Associates Carib Trans Caribbean Associated Attorneys Caribbean Cable Communications (Anguilla), Ltd Caribbean Juris Chambers Church Of God (Holiness) Preschool Ciao Pizza Collen Clothings & Home Fashion Connies Home Centre Coyaba Manor Cuisinart Resort & Spa D-3 Enterprises Ltd./Royal Sun Alliance & Atlantic Delta Petroleum Anguilla Ltd Diamonds International Limited Digicel Easy Corner Villas Ellie's Music/Record Shop Elodias Beach Resort English Rose First Caribbean International Bank Foods Ninety Five Four Star (Amerijet) Gorgeous Scilly Cay Harney Westwood & Riegels Services (Anguilla) Ltd Isaura Villas Island Car Rental Island Construction J.T.C Customs Brokerage & Shipping Agents KCW et al Keene Enterprises Keesha Fleming Law Office Keithley F. Lake & Associates Kerwin Kottages KPMG Kwik Kopy Le Petit Patissier Koal Keel Co. Ltd. Leon's Tailoring & Dressmaking Light House Restaurant LIME Anguilla Lloyd's Aviation Services Madeariman Reef Mag's Cake Dicor Baking Supplies Mala's Cottage Max Printing Service Mediterraneo National Trucking & Heavy Equipment Optimist Club of Anguilla Paradise Cove Resort Professional Corporate Services, Ltd Professional Digital Services Ltd Rich One Rental & Sales Roadwell Cafi Roy's Bayside Grill Seventh-Day Adventist Church Simply Natural by Yinka Something Special Limited Spyglass Hill Villa Tasty's Restaurant TE Wade Construction & Architectural Design The Overlook Restaurant The Pumphouse The Purple Rose Florist Tri-Us Inc Tropical Distributors Co. Ltd. Tropical Flower Ltd U.W.I. Distance Education Centre Ultimate Dvd's Plus Veya Restaurant Vinca Plumbing Co.Ltd Weblinks Ltd. Zara's Seafood Restaurant Businesses are required by law, to complete this questionnaire and upon completion the data supplied to the Department becomes confidential. The protection of the collected data is legislated and guaranteed, under the Statistics Act of Anguilla. Additionally under Section 19 of the Statistics Act of Anguilla, any person guilty of an offence against this Act or any regulation made thereunder for which no special punishment is provided is liable on summary conviction to a fine of $3,000, and in default of payment to imprisonment for a period of 6 months, and in the case of a continuing offence to a further fine of $100 for each day on which the offence continues after conviction. We are kindly and finally requesting that the completed form(s) be returned to the Statistics Department by Friday, 22nd May 2009 by mail in the self-addressed envelope enclosed, fax or e-mail media (please request an electronic version). Failing this the Statistics Department would be left with no choice but to seek the assistance of the Attorney Generals Chambers. Should anyone have any questions or difficulties when completing the questionnaire please do not hesitate to contact us for assistance at telephone number 497-2451 Ext 2874 or 497-5731. We would like to take this opportunity to thank persons in advance for taking the time to provide the requested information. The Anguilla Statistics Department would like to take this opportunity to thank all those businesses that have already returned their questionnaires. -----BEGIN PGP SIGNATURE----- Version: 9.10.0.500 wsBVAwUBSh1DJ8UCGwxmWcHhAQEh1Af/ZXoktUX8wlwGBUEKbKa4Y/DA72l/4jOl WTh4atcJA+uDF30bdysQeP6khay0KZmyjG9APEIShcz4FyGhdg6IgOR4CFw4mN9f 7Q//EL2a0MuqaUcpXbhZlvVXXvcgI8UvS+7JmdrDCsUKzRs43Xz1RHfmhcC84+kL Ex3vF1jS5mf81sT/P6/+Uj9KhDv3eAZ6BZ2jd5dr75+tOn7IgCtMiLlu/xQu/2w6 B16bUg4Z2rMQspxtehQ1PgagKVqREgl1+aw0aSnWz4jFzsioD6fGxHquAax7NFyh V8Y3K1cQ1eRF0l8CBJHU+XWoNH6+Ce0Z2fQvkc0Ce5HsRlK8hz8+eA== =qg14 -----END PGP SIGNATURE-----

1 0