July 2018 - cypherpunks-legacy

Conspiracy Theory O' The Day
by Udhay Shankar N 06 Jul '18

06 Jul '18

I just got a batch of spam: perfectly justified blocks of random-looking characters. Makes me wonder if somebody is trying to train Bayesian filters to reject PGP messages. Udhay -- ((Udhay Shankar N)) ((udhay @ pobox.com)) ((www.digeratus.com)) --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

ccml Trauma management in Iraq
by Eric Hodgson 06 Jul '18

06 Jul '18

The Journey Through Trauma U.S. troops who survive the critical 'golden hour' after being seriously wounded in Iraq owe their lives to a fast-acting team of battlefield medics, pilots, nurses and surgeons. By David Zucchino, LA Times Staff Writer April 3, 2006 http://www.latimes.com/news/nationworld/nation/la-na- wounded3apr03,0,3069118.story As Lance Cpl. Ryan Buchter lay bleeding in the Iraqi desert, his fate hinged on the efficiency of a medical lifeline that stretches halfway around the world. From that moment forward, hundreds of strangers would work to save him. Buchter's platoon was in a village called Husaybah on Nov. 8, searching for the enemy. He was standing in the doorway of a farmhouse when an insurgent inside rolled a grenade at his feet. ADVERTISEMENT The explosion shredded Buchter's left leg as superheated shrapnel tore through muscles and tendons. More shrapnel crushed his right hand and sliced into his nasal cavity. Buchter groped for his nose but couldn't feel it. He thought it had been blown off. He leg was so shattered that he was certain he would lose it, and he imagined being left crippled at age 20. "And not once did I cry," he recalled later, "until I thought, like, I was going to lose my leg and stuff." A Marine applied a pressure bandage to Buchter's leg, trying to stop the bleeding. Another wrapped his hand and pressed gauze against his pulverized nose. The Marines quickly loaded Buchter into an armored vehicle, which delivered him to a medical aid station nearby. Buchter survived the "golden hour" the 60 minutes following a serious battlefield wound, when the speed and competence of emergency treatment can mean the difference between life and death. Ordinary fighting men teamed with doctors, surgeons and nurses to keep him alive. His fellow Marines what the military calls his "battle buddies" were able to stanch his bleeding by putting their combat lifesaving training to quick use. Exsanguination, or bleeding to death, is the leading cause of death for American troops in Iraq. As a military doctor examined his leg inside the aid station, Buchter was alarmed by the concerned look on the man's face. "If I lose my leg, I'm coming back to get you," he told him. The doctor assured Buchter that his leg would be saved. "You've got my word," he said. Then a surgeon arrived and warned Buchter that he might indeed lose his leg. The best option to save it, he told him, was a very painful and sometimes disfiguring surgery called a fasciotomy, the extensive cutting and cleaning of the wound. "And I was like, 'Cut me up if you have to. I just don't want to lose my leg,' " Buchter recalled. The medical odyssey of this Marine was just beginning. Buchter was now a patient in a virtual assembly line of care. It begins with soldiers and medics on the battlefield and shifts quickly to helicopter crews who pluck the wounded from kill zones. It continues to surgeons and nurses and X-ray technicians at desert facilities, and to virtual flying hospitals that airlift the wounded from Balad to a U.S. military hospital in Germany. It leaps the Atlantic to major military medical centers in Texas and Washington, D.C. It passes through military hospitals from New York to California. It culminates with months of painstaking physical and occupational therapy in hospital wards and private homes. About 17,400 wounded have been treated since the war began three years ago. The fulcrum for treatment in Iraq is the U.S. Air Force Theater Hospital in Balad. In addition to the troops brought directly to the hospital, any seriously wounded American must make a stop in Balad to be flown for treatment in Germany. The facility is housed inside three dozen tents and three trailers on the packed sands of a former Iraqi air force base 50 miles north of Baghdad. Sandbags, concrete blast walls and concertina wire provide protection from insurgents, car bombs and mortars. The military says no injured American is more than 30 minutes from Balad or one of three combat support hospitals operated by the Army. The rapid evacuation of wounded troops begins with Black Hawk medevac crews of four nicknamed "dust-off" teams trained to respond rapidly to distress calls from the battlefield. >From their dusty tent base about a mile from the hospital, the Army air ambulance companies keep three helicopters and crews ready at all times. The copters occupy a corner of the air base, the thumping of their rotors competing with the roar of F-16s taking off and the low hum of armed reconnaissance drones. The crews are called to action by "nine-lines," the emergency radio calls from the battlefield that provide nine essential bits of information: location, number of wounded, whether the landing zone is "hot," or under fire, and so on. In most cases, the crews say, their helicopters lift off within eight to 10 minutes ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] The Third Annual Workshop on Economics and Information Security
by Dave Farber 06 Jul '18

06 Jul '18

> > The Third Annual Workshop on > Economics and Information Security > (WEIS04) > May 13-14, 2004 > University of Minnesota > http://www.dtc.umn.edu/weis2004 > > Submissions due: March 1, 2004 > > How much should we spend to secure our computer systems? Can we > determine a.which investments will provide the best protection? > How will > we know when we've reached our goals? Can market forces ensure that > firms will act to improve security? Can incentives align the goals of > employees with the security goals of their employers? > > While security technologies have benefited from decades of study, > there has been a dearth of research into decision making > tools required > to choose among these technologies and employ them properly. The > growing importance of information security and the failings of > technology-centric approaches have made security economics an > area ripe > for new research. There is much work to be done both in applying > existing economic tools to today's security questions and in > pioneering > new economic approaches to address problems unique to the study of > security. > > The Third Annual Workshop on Economics and Information > Security (WEIS04) > is a successor to the two pioneering workshops on this > subject, held in > 2002 at UC Berkeley and in 2003 at Univ. Maryland. > Information about them > is available at URLs given at end. > > We encourage economists, computer scientists, security specialists, > business school faculty, and industry experts to submit > original research > to the 2004 conference. We would especially like to > encourage collaborative > research from authors in multiple fields. Among past and > suggested topics are: > > Game theoretic security models Analysis of security > solutions market > Security investment optimization Threat modeling > Information sharing Risk management > Algorithmic mechanism design Security metrics > DRM and customer lock-in Security loss estimation > Economics of privacy Cyberterrorism > Behavioral security economics Economics of pseudonyms > Reputation systems Case studies > > There will be no printed proceedings of this workshop, but > as with the > preceding workshops, authors of accepted papers will be > encouraged to post > their papers and presentation decks on the conference site. > There may later be > a printed volume of selected papers from the workshop, > similar to the volume > based on the first two workshops that is in preparation. > > Submissions should not exceed approximately 8,000 words > (i.e., about 12 single > spaced pages in a standard 11 point font). They must be > submitted by March 1, > 2004. Position papers of significantly shorter length are > also welcome. > Notification of acceptance for the program will be sent by > April 1, 2004. > Submissions should be sent, preferably in PDF format, to > weissub(a)dtc.umn.edu. > For general information about the conference, check the website: > http://www.dtc.umn.edu/weis2004/ or email weisinfo(a)dtc.umn.edu. > > Program Committee: > > Alessandro Acquisti, Heinz School, Carnegie Mellon University > Ross Anderson, Computer Laboratory, Cambridge University > Jean Camp, Kennedy School of Government, Harvard University > Li Gong, Sun Microsystems > Larry Gordon, Smith School of Business, University of Maryland > Marty Loeb, Smith School of Business, University of Maryland > Andrew Odlyzko (co-chair), Digital Technology Center, > University of > Minnesota > Stuart Schechter, Division of Engineering and Applied > Sciences, Harvard > Bruce Schneier (co-chair), Counterpane Internet Security > Doug Tygar, Computer Science and Information Management, > UC Berkeley > Hal Varian, School of Information Management and Systems > and Economics > Dept., UC Berkeley ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Postfix 2.1 Released
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/04/23/1356214 Posted by: michael, on 2004-04-23 15:14:00 Topic: software, 109 comments from the got-mail? dept. [1]MasTRE writes "After an extended period of polishing and testing, [2]Postfix 2.1 is released. Some highlights: complete documentation rewrite (long overdue!), policy delegation to external code, real-time content filtering _before_ mail is accepted (a top 10 most requested feature in previous versions), major revision of the LDAP/MySQL/PGSQL code. Version 2.2 is in thw works, which promises even more features like client rate limiting and integration of the TLS and IPv6 patches into the official tree. There's never been a better time to migrate from [3]Sendmail (just _had_ to get that in there ;)." [4]Click Here References 1. mailto:dukeN.0@S.P.A.M.mastre.k0m 2. http://www.postfix.org/ 3. http://sendmail.org/ 4. http://ads.osdn.com/?ad_id=2589&alloc_id=6221&site_id=1&request_id=5961291&… =click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: BGP (in)security makes the AP wire
by Neil Harris 06 Jul '18

06 Jul '18

On 18/02/11 12:26, Eugen Leitl wrote: > On Sun, May 09, 2010 at 09:38:18AM -0700, Joel Jaeggli wrote: > >> geographic location doesn't map to topology > In LEO satellite constellations and mesh wireless it typically does. > When bootstrapping a global mesh, one could use VPN tunnels over > Internet to emulate long-distance links initially. > > Eben Moglen recently proposed a FreedomBox intitiative, using ARM > wall warts to build an open source cloud with an anonymizing layer. > Many of these come with 802.11x radio built-in. If this project > ever happens, it could become a basis for end-user owned > infrastructure. Long-range WiFi can compete with LR fiber > in principle, though at a tiny fraction of throughput. > "Tiny fraction" is putting it mildly. I once considered starting up a low-infrastructure wireless ISP using mesh radio based on wifi radio technology adapted to work in licensed bands. If you work out the numbers, the bandwidth you get in any substantial deployment is pitiful compared to technologies like DSL and cable modems, let alone fiber. New technologies such as distributed space-time multipath coding on the wireless side, and multipath network coding on the bitstream side, look like the way forward on this, but these are brand new, and still the subject of research -- you certainly can't just hot-wire these onto wifi hardware. >>> Presumably, one could prototype something simple and cheap at L2 level >>> with WGS 84->MAC (about ~m^2 resolution), custom switch firmware and GBIC >>> for longish (1-70 km) distances, but without a mesh it won't work. > The local 64 bit part of IPv6 has enough space for global ~2 m resolution, > including altitide (24, 24, 16 bit). With DAD and fuzzing lowest > significant bits address collisions could be prevented reliably. > > Central authority and decentralism can co-exist. Indeed. The fact that the usable bandwidth resulting from ad-hoc mesh wiki would be tiny compared to broadband connections doesn't mean this sort of thing isn't worth trying: a few tens of kilobits a second is plenty for speech, and even a few hundred bits per second useful for basic text messaging. Given that the cost of doing this is almost zero, since only software is required to implement it on any modern wifi/GPS equipped mobile hardware, this seems like a great thing to have in the general portfolio of networking technologies: having something like this available could be invaluable in disaster/crisis situations. -- Neil ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: BGP (in)security makes the AP wire
by Neil Harris 06 Jul '18

06 Jul '18

On 18/02/11 12:26, Eugen Leitl wrote: > On Sun, May 09, 2010 at 09:38:18AM -0700, Joel Jaeggli wrote: > >> geographic location doesn't map to topology > In LEO satellite constellations and mesh wireless it typically does. > When bootstrapping a global mesh, one could use VPN tunnels over > Internet to emulate long-distance links initially. > > Eben Moglen recently proposed a FreedomBox intitiative, using ARM > wall warts to build an open source cloud with an anonymizing layer. > Many of these come with 802.11x radio built-in. If this project > ever happens, it could become a basis for end-user owned > infrastructure. Long-range WiFi can compete with LR fiber > in principle, though at a tiny fraction of throughput. > "Tiny fraction" is putting it mildly. I once considered starting up a low-infrastructure wireless ISP using mesh radio based on wifi radio technology adapted to work in licensed bands. If you work out the numbers, the bandwidth you get in any substantial deployment is pitiful compared to technologies like DSL and cable modems, let alone fiber. New technologies such as distributed space-time multipath coding on the wireless side, and multipath network coding on the bitstream side, look like the way forward on this, but these are brand new, and still the subject of research -- you certainly can't just hot-wire these onto wifi hardware. >>> Presumably, one could prototype something simple and cheap at L2 level >>> with WGS 84->MAC (about ~m^2 resolution), custom switch firmware and GBIC >>> for longish (1-70 km) distances, but without a mesh it won't work. > The local 64 bit part of IPv6 has enough space for global ~2 m resolution, > including altitide (24, 24, 16 bit). With DAD and fuzzing lowest > significant bits address collisions could be prevented reliably. > > Central authority and decentralism can co-exist. Indeed. The fact that the usable bandwidth resulting from ad-hoc mesh wiki would be tiny compared to broadband connections doesn't mean this sort of thing isn't worth trying: a few tens of kilobits a second is plenty for speech, and even a few hundred bits per second useful for basic text messaging. Given that the cost of doing this is almost zero, since only software is required to implement it on any modern wifi/GPS equipped mobile hardware, this seems like a great thing to have in the general portfolio of networking technologies: having something like this available could be invaluable in disaster/crisis situations. -- Neil ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Anonymous Publishing Is Dead.
by Anonymous Person 06 Jul '18

06 Jul '18

I know it is dead, because I have tried to do it, and I can assure you it is dead.Text is easy of course I can still blast a simple email out to a mailing list, I can lay my claims out in 7bit ASCII and let the world judge the merits solely on this simple medium.But media publishing a story with supporting images, scans, video or audio it is dead, left only to the elites. And perhaps worst of all is the promise made by all of you that if you just.... try a little harder, if you just use this service over here, if you just think about it another way that it is still possible.It is not.Some time ago as an experiment I began the process to publish material fully anonymously no compromises.I obtained a prepaid line of credit, paid in cash, verified with a prepaid telephone, also paid in cash, and only turned on in an ambiguous physical location.And I set about to find a Virtual Private Server I could run a Tor Hidden Service on.My requirements throughout all of this were si mple: use Tor for everything, pay cash or cashequivalent for everything, leave no account on a service run by a US/UK/AUS/NZ/CA company, have the VPS hosted outside the same, pay a reasonable sum.I needed an email of course.Nymservers like http://isnotmy.name/ or http://mixnym.net should have been the solution but of course they didn't work.No amount of guesswork or trial and error got me a nym.Free webmail became the next goal.The more trustworthy (gmail), the less satisfactorily anonymous it was.The easier it was to register (in.com) the less trustworthy it was deemed.After signing up for a lowtrust but easytoget email, I narrowed down my hosting options to a group of VPS in the price range, hosted outside the 'bad' countries, and whose company itself was also outside.There aren't a lot.The next problem became finding a VPS I could pay for.You see, most VPS sellers are small resellers and don't process their own credit cards they outsource it to a payment processor, usu ally Paypal. Paypal doesn't work.Paypal or AlertPay too stringent verification; Liberty Reserve blocks Tor; CashU no easily found online merchant able to convert from a prepaid Credit Card; one after another all online payment methods fell by the wayside.You might think 'Bitcoin'.You would be wrong.No bitcoin service accepts any anonymous funding source most only accept bank transfers.Apparently people performed chargebacks on credit cards to defraud the merchants.I can't blame them for this, but it certainly kills the idea of 'anonymity'.And I don't trust the blockchain to provide anonymity.After finding one of three or four VPS' I thought I could pay for, I encountered the next obstacle: MaxMind.MaxMind is a fraud detector built into WHMCompleteSolution which in turn is the VPS management tool used by every budget VPS.I set off every detector it had: proxy software, low trust email account, strange addresses, no valid phone number, etc etc.When I inquired to one compan y about this, I was laughed off.Even though I was willing to let them charge my card and sit on it for a month before providing service no such luck.At this point, I needed to find a company large enough they processed their own credit cards, didn't block Tor, and didn't use fraud detectors.I found one, a competitor to Amazon EC2, that I thought I could fall through the cracks of.It didn't like my low trust email address, but after enough searching, I found an ISP I could get an account on without paying.After getting that, creating and verifying an account, and finally set up to make my payment... the prepaid card is declined.There's no explanation, it just didn't work.I thought at this point, perhaps there was a service that could be used.There was an announcement recently: http://karelbilek.com/anontorrent/ Supposedly this guy will seed anything until it has 20 seeders of its own.Except the file limit is 50MB.And you can't upload copyrighted material.How about any of the muchacclaimed 'leak sites' that spun up after Wikileaks shuttered their wiki and submission system?Well, I went through all of these: leakdirectory.org/index.php/LeakSiteDirectory and all of them seemed to be either wannabes who had never published a thing or news organizations who were security illiterate and had no way to accept content.Anonymous Publishing Is Dead.You may seek to respond with the 'right way' to do it, the company you know will let me fall through the cracks, the trick you use to whitelie your way through the process.Don't bother.If there is a way through, and I'm not convinced there is, it is so difficult to find that a technically unsavvy user would never be able to; and even technically savvy users like myself who understand all the tricks of firewalling off my machine so nothing but Tor escapes are groping blindly for it, unlikely to find it.What can be done about this?What compromises are 'safe'?Is a Hidden Service sufficiently trustworthy to host any material, and have it stand up to investigation when the server running it is in your name?Is the correct approach not to publish anonymously at all, as cryptome.org does?Should we rely on the Streisand effect, bittorrent, newsgroups, something else?These are mostly rhetorical questions.My purpose in this email is to tell you that anonymous publishing is an unsolved problem.Any solution available today is not robust: it falls down in some situation: content, capacity, anonymity, or something else.What can be done about it? What will be done about it?Dear tortalk! Get Yourself a cool, short @in.com Email ID now! _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] The Third Annual Workshop on Economics and Information Security
by Dave Farber 06 Jul '18

06 Jul '18

> > The Third Annual Workshop on > Economics and Information Security > (WEIS04) > May 13-14, 2004 > University of Minnesota > http://www.dtc.umn.edu/weis2004 > > Submissions due: March 1, 2004 > > How much should we spend to secure our computer systems? Can we > determine a.which investments will provide the best protection? > How will > we know when we've reached our goals? Can market forces ensure that > firms will act to improve security? Can incentives align the goals of > employees with the security goals of their employers? > > While security technologies have benefited from decades of study, > there has been a dearth of research into decision making > tools required > to choose among these technologies and employ them properly. The > growing importance of information security and the failings of > technology-centric approaches have made security economics an > area ripe > for new research. There is much work to be done both in applying > existing economic tools to today's security questions and in > pioneering > new economic approaches to address problems unique to the study of > security. > > The Third Annual Workshop on Economics and Information > Security (WEIS04) > is a successor to the two pioneering workshops on this > subject, held in > 2002 at UC Berkeley and in 2003 at Univ. Maryland. > Information about them > is available at URLs given at end. > > We encourage economists, computer scientists, security specialists, > business school faculty, and industry experts to submit > original research > to the 2004 conference. We would especially like to > encourage collaborative > research from authors in multiple fields. Among past and > suggested topics are: > > Game theoretic security models Analysis of security > solutions market > Security investment optimization Threat modeling > Information sharing Risk management > Algorithmic mechanism design Security metrics > DRM and customer lock-in Security loss estimation > Economics of privacy Cyberterrorism > Behavioral security economics Economics of pseudonyms > Reputation systems Case studies > > There will be no printed proceedings of this workshop, but > as with the > preceding workshops, authors of accepted papers will be > encouraged to post > their papers and presentation decks on the conference site. > There may later be > a printed volume of selected papers from the workshop, > similar to the volume > based on the first two workshops that is in preparation. > > Submissions should not exceed approximately 8,000 words > (i.e., about 12 single > spaced pages in a standard 11 point font). They must be > submitted by March 1, > 2004. Position papers of significantly shorter length are > also welcome. > Notification of acceptance for the program will be sent by > April 1, 2004. > Submissions should be sent, preferably in PDF format, to > weissub(a)dtc.umn.edu. > For general information about the conference, check the website: > http://www.dtc.umn.edu/weis2004/ or email weisinfo(a)dtc.umn.edu. > > Program Committee: > > Alessandro Acquisti, Heinz School, Carnegie Mellon University > Ross Anderson, Computer Laboratory, Cambridge University > Jean Camp, Kennedy School of Government, Harvard University > Li Gong, Sun Microsystems > Larry Gordon, Smith School of Business, University of Maryland > Marty Loeb, Smith School of Business, University of Maryland > Andrew Odlyzko (co-chair), Digital Technology Center, > University of > Minnesota > Stuart Schechter, Division of Engineering and Applied > Sciences, Harvard > Bruce Schneier (co-chair), Counterpane Internet Security > Doug Tygar, Computer Science and Information Management, > UC Berkeley > Hal Varian, School of Information Management and Systems > and Economics > Dept., UC Berkeley ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Postfix 2.1 Released
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/04/23/1356214 Posted by: michael, on 2004-04-23 15:14:00 Topic: software, 109 comments from the got-mail? dept. [1]MasTRE writes "After an extended period of polishing and testing, [2]Postfix 2.1 is released. Some highlights: complete documentation rewrite (long overdue!), policy delegation to external code, real-time content filtering _before_ mail is accepted (a top 10 most requested feature in previous versions), major revision of the LDAP/MySQL/PGSQL code. Version 2.2 is in thw works, which promises even more features like client rate limiting and integration of the TLS and IPv6 patches into the official tree. There's never been a better time to migrate from [3]Sendmail (just _had_ to get that in there ;)." [4]Click Here References 1. mailto:dukeN.0@S.P.A.M.mastre.k0m 2. http://www.postfix.org/ 3. http://sendmail.org/ 4. http://ads.osdn.com/?ad_id=2589&alloc_id=6221&site_id=1&request_id=5961291&… =click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[tor-talk] Anonymous Publishing Is Dead.
by Anonymous Person 06 Jul '18

06 Jul '18

I know it is dead, because I have tried to do it, and I can assure you it is dead.Text is easy of course I can still blast a simple email out to a mailing list, I can lay my claims out in 7bit ASCII and let the world judge the merits solely on this simple medium.But media publishing a story with supporting images, scans, video or audio it is dead, left only to the elites. And perhaps worst of all is the promise made by all of you that if you just.... try a little harder, if you just use this service over here, if you just think about it another way that it is still possible.It is not.Some time ago as an experiment I began the process to publish material fully anonymously no compromises.I obtained a prepaid line of credit, paid in cash, verified with a prepaid telephone, also paid in cash, and only turned on in an ambiguous physical location.And I set about to find a Virtual Private Server I could run a Tor Hidden Service on.My requirements throughout all of this were si mple: use Tor for everything, pay cash or cashequivalent for everything, leave no account on a service run by a US/UK/AUS/NZ/CA company, have the VPS hosted outside the same, pay a reasonable sum.I needed an email of course.Nymservers like http://isnotmy.name/ or http://mixnym.net should have been the solution but of course they didn't work.No amount of guesswork or trial and error got me a nym.Free webmail became the next goal.The more trustworthy (gmail), the less satisfactorily anonymous it was.The easier it was to register (in.com) the less trustworthy it was deemed.After signing up for a lowtrust but easytoget email, I narrowed down my hosting options to a group of VPS in the price range, hosted outside the 'bad' countries, and whose company itself was also outside.There aren't a lot.The next problem became finding a VPS I could pay for.You see, most VPS sellers are small resellers and don't process their own credit cards they outsource it to a payment processor, usu ally Paypal. Paypal doesn't work.Paypal or AlertPay too stringent verification; Liberty Reserve blocks Tor; CashU no easily found online merchant able to convert from a prepaid Credit Card; one after another all online payment methods fell by the wayside.You might think 'Bitcoin'.You would be wrong.No bitcoin service accepts any anonymous funding source most only accept bank transfers.Apparently people performed chargebacks on credit cards to defraud the merchants.I can't blame them for this, but it certainly kills the idea of 'anonymity'.And I don't trust the blockchain to provide anonymity.After finding one of three or four VPS' I thought I could pay for, I encountered the next obstacle: MaxMind.MaxMind is a fraud detector built into WHMCompleteSolution which in turn is the VPS management tool used by every budget VPS.I set off every detector it had: proxy software, low trust email account, strange addresses, no valid phone number, etc etc.When I inquired to one compan y about this, I was laughed off.Even though I was willing to let them charge my card and sit on it for a month before providing service no such luck.At this point, I needed to find a company large enough they processed their own credit cards, didn't block Tor, and didn't use fraud detectors.I found one, a competitor to Amazon EC2, that I thought I could fall through the cracks of.It didn't like my low trust email address, but after enough searching, I found an ISP I could get an account on without paying.After getting that, creating and verifying an account, and finally set up to make my payment... the prepaid card is declined.There's no explanation, it just didn't work.I thought at this point, perhaps there was a service that could be used.There was an announcement recently: http://karelbilek.com/anontorrent/ Supposedly this guy will seed anything until it has 20 seeders of its own.Except the file limit is 50MB.And you can't upload copyrighted material.How about any of the muchacclaimed 'leak sites' that spun up after Wikileaks shuttered their wiki and submission system?Well, I went through all of these: leakdirectory.org/index.php/LeakSiteDirectory and all of them seemed to be either wannabes who had never published a thing or news organizations who were security illiterate and had no way to accept content.Anonymous Publishing Is Dead.You may seek to respond with the 'right way' to do it, the company you know will let me fall through the cracks, the trick you use to whitelie your way through the process.Don't bother.If there is a way through, and I'm not convinced there is, it is so difficult to find that a technically unsavvy user would never be able to; and even technically savvy users like myself who understand all the tricks of firewalling off my machine so nothing but Tor escapes are groping blindly for it, unlikely to find it.What can be done about this?What compromises are 'safe'?Is a Hidden Service sufficiently trustworthy to host any material, and have it stand up to investigation when the server running it is in your name?Is the correct approach not to publish anonymously at all, as cryptome.org does?Should we rely on the Streisand effect, bittorrent, newsgroups, something else?These are mostly rhetorical questions.My purpose in this email is to tell you that anonymous publishing is an unsolved problem.Any solution available today is not robust: it falls down in some situation: content, capacity, anonymity, or something else.What can be done about it? What will be done about it?Dear tortalk! Get Yourself a cool, short @in.com Email ID now! _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0