July 2018 - cypherpunks-legacy

Top firms retreat into bunker to ward off 'Anarchists'
by Moon Kat 05 Jul '18

05 Jul '18

Hi Matt Not sure if you've seen this one already but here goes. Quite where the anti-capitalists are going to get a thermonuclear bomb from isn't explained in the article but surely such a device would compromise their "Neo-Luddite" principles anyway? Yours, in a fallout shelter, somewhere west of London dK ------------------------------------------------------------------------ TOP FIRMS RETREAT INTO BUNKER TO WARD OFF 'ANARCHISTS' "Some of Britain's biggest companies are running their Internet operations on systems installed in a 300ft-deep nuclear blast-proof bunker to protect customers from violent anti-capitalist campaigners. They are renting space in hermetically sealed rooms capable of withstanding a one Kiloton explosion, electro-magnetic 'pulse bombs', electronic eavesdropping and chemical and biological warfare." This is from an article by Steve Boggan in the The Independent, 13 June 2001 - http://news.independent.co.uk/digital/update/story.jsp?story=77374: It seems that hundreds of companies have already installed systems in The Bunker - formerly known as RAF Ash, outside Sandwich in Kent - and dozens more are understood to be queuing up for space. The article quotes a Dr Ian Angell, professor of information systems at the London School of Economics and author of The New Barbarian Manifesto, as saying: "This isn't paranoia or fantasy, this is the future. There are sophisticated anti-capitalists out there who feel a great deal of resentment against the business world. These are the new Luddites and, given half a chance, they would smash the machine to pieces." Behind The Bunker is a company called AL Digital Communications, established by the brothers Adam and Ben Laurie and Dominic Hawken. "The AL Digital team made a sealed bid - still secret, according to the Ministry of Defence - and the 60,000sq ft bunker with 18 acres of land was theirs," writes Boggan. There are three back-up power systems big enough to fire up a small town. There is also a fire station, vast underground fuel and water tanks and an array of cameras on corridors and servers. "You have to understand. Future wars will be fought by capitalists and anti-capitalists as society polarises," Professor Angell is reported as saying. "When that happens, control of information will be as important as control of territory used to be in conventional conflicts. If you can stop your enemy from destroying your information, then you have a good chance of winning the war." __________________________________________________________________________ Distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. --- ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

[serval-project-dev] Africa's mobile economic revolution | Technology | The Observer
by Romana Challans 05 Jul '18

05 Jul '18

http://www.guardian.co.uk/technology/2011/jul/24/mobile-phones-africa-micro… -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] 'bullet proof' hosting
by Eric King 05 Jul '18

05 Jul '18

Beware of some of the lawful access regimes in Europe - particularly Sweden. The powers granted under their FRA law were only curtailed at the last moment, and it still isn't brilliant. There were a number of government bills in 2006 that extended the use of secret surveillance, including inter alia a bill to allow telephone tapping for preventive reasons as well as bugging of conversations with the help of hidden microphones. On 31 May 2006 the Parliament decided to postpone discussion on the bill for at least a year and "insisted that safeguards against abuse of power be introduced into the bill, including an obligation for police to inform those subject to secret surveillance whenever this is considered safe for investigative reasons."[66] In 2007, a proposed bill would allow the National Defence Radio Establishment (FC6rsvarets Radioanstalt, FRA) permission to use data mining software to search for sensitive keywords in all phone and email communications passing through cables or wires across the country's borders without a court order.[67]Until then the FRA could only listen to radio transmissions and did not have the authority to monitor and analyse Internet data traffic.[68] The FRA would need approval from a parliamentary committee on military intelligence affairs and would only be permitted to "tap into communications through pattern analysis and key word searches, and would not be entitled to target specific individuals."[69] Before this bill was approved on 18 June 2008, such traffic could only be monitored with court approval if police suspected a crime, although the agency was free to spy on airborne signals, such as radio and satellite traffic. The new legislation became widely controversial and has posed a threat to cross-border communications.[70]It allows for the interception of e-mail, telephone and faxes, and is therefore a threat to anyone dealing with a Swedish organisation.[71] Even where domestic Internet communication is intended for two persons residing in Sweden, the same information may cross national borders through Germany, Denmark, and the USA.[72] The implication is that people residing outside of Sweden, as well as Swedes, may be subject to the surveillance of FRA.[73] The FRA wiretapping law adopted on 18 June 2008 consists of four statutes: a newly adopted statute on signals intelligence and changes in three other statutes.[74] "FRA has a mandate to search for 'external threatsb, which involves everything from military threats, terrorism, IT security, supply problems, ecological imbalances, ethnic and religious conflicts, and migration to economic challenges in the form of currency and interest speculation."[75] Causing further controversy is the lack of any requirement that the FRA should have a reason to suspect crime or need a court order before being allowed to conduct surveillance of Swedish residents.[76] After criticism by privacy groups and a massive public debate about such sweeping powers, the Act was amended.[77] In addition, "a legal complaint has been made to the EU in July about this Act's possible breach of the EU's privacy and discrimination law with regard to cross-border legal consultations."[78]The European Commission, who would have to bring formal infringement procedures against Sweden, has not yet made any such action.[79] The law was supposed to enter into force by January 2009 but after the massive debacle surrounding the issue in Sweden, the government proposed a modified bill that included a number of privacy improvements to the original legislation. Among other aspects, the details of FRA monitoring are now subject to political scrutiny and the FRA must seek permissions for every search made. The amendment was approved by the Parliament on 14 October 2009 and the new, restricted competences of the FRA came into force on 1 December of the same year.[80] As of September 2010, the FRA has still to initiate its surveillance scheme. Technical problems regarding access points as well as resistance from some Internet service providers have allegedly delayed the actual surveillance from starting. https://www.privacyinternational.org/article/sweden-privacy-profile Eric On 24 Aug 2011, at 00:27, Moritz Bartl wrote: > On 23.08.2011 21:11, Miles Fidelman wrote: >>> With this in mind, can anyone suggest any methods for 'bullet proof' >>> hosting that functions under a jurisdiction that upholds freedom of >>> expression in ways that don't lead to such 'take down' notices? >> The obvious strategy is to mirror on multiple hosts in different >> jurisdictions, and make sure that domain registration and nameservice is >> in a country that values freedom of expression (or is spammer friendly). > > I agree. > > It is best to approach potential hosters up front with a description of > the project and worst case scenarios/attacks (complaints, takedown > notices, etc). Sweden and the Netherlands were mentioned to have pretty > good privacy laws, and for most cases it is not necessary to go with > advertised "bullet proof" ISPs such as PRQ, which in general are very > pricey. Iceland is even more expensive. Another well known decent > privacy ISP for example is shinjiru in Malaysia ( > http://www.shinjiru.com/ ). If you need more detailed recommendations, I > can compile a larger list of potential ISPs to contact, but again, it > should not be hard to find 2-3 good ISPs in different jurisdictions > willing to stand some heat. > > -- > Moritz Bartl > https://www.torservers.net/ > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech > _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Roger's status report, May 2012
by Roger Dingledine 05 Jul '18

05 Jul '18

Hi folks! As the Tor Project has grown in scope, we've been struggling to keep up with simultaneously a) doing all the development that needs to be done (including meeting deliverables for our funders), and b) keeping the community up-to-date on our in-progress work. Lately I've been writing monthly status summaries, much like what we have our GSoC students do. In an effort to be more transparent, I'm going to start sending them to tor-talk rather than just to the other developers. Note that I will need to omit or anonymize things sometimes -- some research groups I meet with don't want to announce their paper draft until it gets accepted at a conference, some funders don't want the publicity that would come from admitting their interest in Internet freedom, etc. I'll try to err on the side of sunlight though. For those here who are totally taken by surprise by this email (and the fact that Tor does things :), I encourage you to to lurk on the irc channels if you want to follow along more closely. https://www.torproject.org/about/contact#irc And finally, please do ask questions! Here's your chance to understand my role in Tor and how it fits with what other people are doing. But since the root of the problem here has been that we do too many things and don't have time to do more, please focus on your most burning question(s). --Roger ------------------------------------------------------------------------ Here's what I said at the beginning of May that I hoped to do: > - Allocate FOCI papers to reviewers. Done. We got 20 submissions, and reviewing is ongoing. We'll pick some in early June. https://blog.torproject.org/blog/call-papers-free-and-open-communications-i… https://www.usenix.org/conference/foci12/ > - Actually release 0.2.2.36, this time for sure, no take-backs. Done. https://lists.torproject.org/pipermail/tor-announce/2012-June/000084.html > - Help Radu put in the NIST proposal. Done. We submitted a grant proposal to work with a team of research institutions on questions around privacy, identity, and mobile. I'll write more details here if the grant agency turns out to like the proposal. > - Help Nick and Mike interview and make decisions about core developers. Done (well, mostly they did it). https://blog.torproject.org/blog/dedicated-core-tor-developer https://www.torproject.org/about/jobs-coredev.html.en Our new core developer is getting up to speed now. I'm really excited that this will mean Nick can make more progress on core development! I'll let them make a further announcement when they're ready. > - I'm going to try to be absent from the world May 11-15. Done (vacation). > - May 14 is the PETS stipend deadline. After that I'll help Andrei > allocate the stipends. The PETS people wanted us to push the deadline back to June 1. I dealt with all the mails and allocated stipends in early June. http://petsymposium.org/2012/stipends http://petsymposium.org/2012/ > - Get the PETS papers up on the PETS website. They're up at http://freehaven.net/anonbib/papers/pets2012/ and I will add links to http://petsymposium.org/2012/program.php but I'm doing a cursory check with Matt first to see if he knows whether any authors want to keep their papers unpublished for now. > - Launch a working-group of pluggable transport developers and > researchers, and make sure they all know about each other. Not done. I'll aim to get a pluggable transport development page up on the website in June. > - Try to help vmon and Zack Weinberg feel more accepted in the > community, since I'm the backup mentor for vmon's gsoc project. Ongoing. We succeeded at getting the Stegotorus code approved for publication by Zack's funders, so vmon's gsoc project can proceed as planned. You can read vmon's periodic status reports on the tor-dev mailing list. Next step is to help get the Stegotorus git repository cleaned up, make the code itself more functional, and encourage them to make a tech report version of the paper available. https://gitweb.torproject.org/stegotorus.git > - Flesh out more SponsorZ tasks so we're more aware of our future. Not finished. But you can follow along on our current "I wish we had a funder for this task so we could spend time on it" task list: https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorZ > - Help SponsorF come up with metrics by which the SponsorF Red Team > will judge the project's success. Not done. I expect more progress in June though -- stay tuned. > - Rewrite the "how governments and military use Tor" section on the > webpage, since they actually don't run hidden services to our knowledge, > but we do have good new stories like IWF's use of Tor. Not done. More generally, I wish I had some extra weeks to sit down and update the FAQ and other web pages, since it's been years since I wrote many of them. > - I'm going to Oakland Done. http://www.ieee-security.org/TC/SP2012/ I talked to a bunch of people, such as - Micah Sherr, professor at Georgetown, who wants to help us with ExperimenTor and simulation bugs. I will send him a pile of trac ticket links around our recent performance simulation problems. https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/Performance http://crysp.uwaterloo.ca/software/exptor/ - Rob Cunningham who is Kevin Bauer's new boss. I spent a while trying to convince Rob that he should have Kevin work on Tor simulation and performance questions as part of his new job at Lincoln Labs. http://www.mit.edu/~ke23793/ - Camilo Viecco, who now works for Mozilla on adding privacy features to Firefox. He has been frustrated so far at getting his commits in: he has buy-in from the security team, but other teams block his commits with statements like "it's an arms race we can't win, so don't even bother trying to make things better". I encouraged him to get his mid-level manager to play the politics game better on his behalf. - Tariq Elahi, Ryan Henry, and Tao Wang are grad students from Ian's group doing interesting things: http://crysp.uwaterloo.ca/ In particular Tariq is working on a paper showing that we shouldn't replace guards in our list as soon as they go away, since it significantly increases the exposure to other guards. I helped Tariq quite a bit with his paper. http://cacr.uwaterloo.ca/techreports/2012/cacr2012-11.pdf But Ryan is working on privacy-preserving ways to gather Tor statistics data, and I don't have time to help him figure out what most needs collecting. Please jump in if you're interested. http://www.cs.uwaterloo.ca/~rhenry/pdf/torstat-poster-Oakland.pdf - I talked to several anonymous communications professors about having them use their sabbatical to become the Tor research coordinator. What we need to replace me as research coordinator is not a grad student -- we need someone who already knows how to set a research agenda and get other people to do it, i.e. a professor. Several are going on sabbatical soon, and we could supplement their salary for cheap. - I spoke at length with the authors of the "Peekaboo" and "LasTor" papers, and somewhat less with the LAP authors. I'll publish some paper analyses and summaries on the blog as I get time. http://freehaven.net/anonbib/#oakland2012-peekaboo http://freehaven.net/anonbib/#oakland2012-lastor http://freehaven.net/anonbib/#oakland2012-lap > - I'll aim to drop by SponsorF and/or Stanford at the end of the month > to give them some facetime. I met with Zack Weinberg and Jeroen Massar. I've been working with Zack to kick SponsorF into making the Stegotorus code available. I think it will benefit a lot from the light of day -- we've already discovered a lot of usability issues. I fear that key parts of the underlying design (like, say, the Stego part) are going to need to be discarded though. Jeroen is working on their "get lots of bridge addresses and handle routing traffic through them at the iptables layer" design. They're also working on a program to take in a blob (e.g. from bridgedb), do some network interactions, and produce a bridge address -- see also item 7 on https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorF/Year2 I expect that I'm going to have to wrestle them to the ground to make it open before we can find out if it will be of any use to us or the world. The wrestling will continue at the upcoming SponsorF meeting in June. Also stay tuned for their FOCI paper describing the overall architecture. I also met with David Fifield, the Flashproxy developer (grad student at Stanford, and an nmap developer). I now believe that Flashproxy is ready for further deployment and use by real users. The main drawback is that the censored users currently need to have a public IP address (i.e. not be behind a NAT) to use it. I expect as websockets tries harder to replace Skype, it will be easier for us to do nat piercing inside the browser and resolve this limitation. https://gitweb.torproject.org/flashproxy.git/blob/HEAD:/README http://crypto.stanford.edu/flashproxy/ http://crypto.stanford.edu/flashproxy/flashproxy.pdf At the upcoming developer meeting in Florence, we should have a discussion about all these great people doing great work for Tor that aren't hearing our status report discussions currently. Maybe I should contribute to the solution by putting my monthly status reports on the blog or on tor-talk. ------------------------------------------------------------------------ Here are some other things I did in May: - Met with two of Rachel Greenstadt's grad students at Drexel University who want to do their class project on Tor after seeing our Berlin 28C3 talk. They had wanted to try to measure linkability between exiting streams on a given circuit. I encouraged them instead to work on https://trac.torproject.org/projects/tor/ticket/5752 and in particular https://trac.torproject.org/projects/tor/ticket/5830 - Talked to Nick Feamster at Georgia Tech (soon to be University of Maryland) about OONI vs his Bismark project. He doesn't think his Bismark devices are big enough to handle Python, so he's been writing his tests in lua. I suggested that OONI and Bismark should at least share a common output format. I think Arturo is right to keep asking him "Are you sure your devices can't run python? Really sure?" http://projectbismark.net/ http://ooni.nu/index.html - Continued to put time into moderating and responding to blog comments. They've turned into a great source of real bugs, especially among Windows users. Let me reiterate my hopes for a forum where we can turn these people into more of a community. If only secure maintainable forum software existed in the world. [Update: one of our new funders has included funding to get some forums up and running and maintained -- I'm not sure on the timeframe for it yet though.] https://blog.torproject.org/ - Turned down an IEEE TDSC academic journal review request, and an IEEE ToN journal review request, because of IEEE's anti-science publishing policy. http://www.researchwithoutwalls.org/ - Our CSET submission comparing Shadow to ExperimenTor got accepted! Details (including a camera-ready version) coming soon. https://www.usenix.org/conference/cset12 ------------------------------------------------------------------------ Here are some items I expect to do in June: - Participate in the Q2 Tor directors board meeting, including approving the updated 2012 budget. - Understand the open positions in our current budget, what funders each one maps to, and what the priorities are in terms of spending the money. Then we can start putting some calls-for-resumes-and-code-samples up on the website, as well as prioritizing which calls we want to do when. Unless I ignore all of this until July. - Get 0.2.3.16-alpha out. Get 0.2.2.37 out. Get 0.2.3.17-alpha out. - Orchestrate the FOCI discussion and select the program. - Tell Micah Sherr and Chris Wacek (Georgetown) about the open simulation questions; and get Rob Jansen (UMN/NRL), Mashael AlSabah (Waterloo), etc a good summary of the current situation. - Read and consider http://microsoftjobsblog.com/zen-of-pm so I can help Adam Shostack help us get a good project manager. - I have a three hour slot at the SponsorF meeting this month. I'm going to try to bring everybody there up to speed on everything. While also letting other people talk for most of the time. Preparing for this talk will be a big part of my June. - Meet with Kevin Dyer's lab at Portland State before the SponsorF meeting. Rob Jansen and Aaron Johnson (NRL) will be joining me. - Help prepare for the SponsorF site visit that will occur a few days before PETS. We'll need to provide slides/etc, and likely even call in and do the phone presentation thing. - Go to Stamford CT to do a Tor talk for one of Ian's past students. http://privacyandsecurity.pbiresearch.com/agenda.html - Write an abstract for the ecrypt talk I'm doing at the workshop before PETS: https://www.cosic.esat.kuleuven.be/ecrypt/provpriv2012/invited.html - Fly to Florence, for the Tor developers meeting and hackfest in July. https://trac.torproject.org/projects/tor/wiki/org/meetings/2012SummerDevMee… https://trac.torproject.org/projects/tor/wiki/org/meetings/2012FlorenceHack… ------------------------------------------------------------------------ Things I'm still dropping the ball on: - I wonder if I should follow up with Carol @ google about our obfsproxy post in February and the interest they expressed in doing a repost on the gsoc blog. https://blog.torproject.org/blog/obfsproxy-next-step-censorship-arms-race http://google-opensource.blogspot.com/ - Transparently document the secteam process, especially since we have concluded to use it far less often and only for critical security things. - Answer the thread between Karsten and Jake where we had an excited volunteer with a clearly useful contribution that we totally dropped on the floor. Try to generalize the experience to improve our response to new contributors. We used to be great at it, and lately we're all overloaded. - Add a "scientific papers" exception to our trademark-faq: I want to give blanket permission to scientific papers to use the word Tor in their paper name, so long as they don't go and write software under that name too. https://www.torproject.org/docs/trademark-faq - Make a plan for fixing all the "CBT sometimes breaks Tor" issues. https://trac.torproject.org/projects/tor/ticket/3443 - Try to teach the Virtus Linux guy about how to make a safe Tor distro. http://sourceforge.net/projects/virtuslinux/ - Start summarizing Tor research papers on the blog more regularly. There have been a huge number of really important research papers lately, and most Tor people don't know about them. Should I summarize them on the blog (for a broader audience), or on tor-dev (for the rest of the Tor developers), or what? - Add Zack Weinberg, David Fifield, etc to tor-assistants, so they can be more integrated into the community. And then to tor-internal. And then dissolve tor-internal and make us all be transparent again. - Figure out where we are on the "change our cipher suite" tickets, and try to help them move forward. https://trac.torproject.org/projects/tor/ticket/4744 - I need new business cards. - Get https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorA through D back up on the wiki somewhere (Andrew took them down since they were concluded, and since they just listed contract deliverables rather than the progress reports and trac ticket links that we've been doing for later funders; but we should keep them there for posterity). _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Top firms retreat into bunker to ward off 'Anarchists'
by Moon Kat 05 Jul '18

05 Jul '18

Hi Matt Not sure if you've seen this one already but here goes. Quite where the anti-capitalists are going to get a thermonuclear bomb from isn't explained in the article but surely such a device would compromise their "Neo-Luddite" principles anyway? Yours, in a fallout shelter, somewhere west of London dK ------------------------------------------------------------------------ TOP FIRMS RETREAT INTO BUNKER TO WARD OFF 'ANARCHISTS' "Some of Britain's biggest companies are running their Internet operations on systems installed in a 300ft-deep nuclear blast-proof bunker to protect customers from violent anti-capitalist campaigners. They are renting space in hermetically sealed rooms capable of withstanding a one Kiloton explosion, electro-magnetic 'pulse bombs', electronic eavesdropping and chemical and biological warfare." This is from an article by Steve Boggan in the The Independent, 13 June 2001 - http://news.independent.co.uk/digital/update/story.jsp?story=77374: It seems that hundreds of companies have already installed systems in The Bunker - formerly known as RAF Ash, outside Sandwich in Kent - and dozens more are understood to be queuing up for space. The article quotes a Dr Ian Angell, professor of information systems at the London School of Economics and author of The New Barbarian Manifesto, as saying: "This isn't paranoia or fantasy, this is the future. There are sophisticated anti-capitalists out there who feel a great deal of resentment against the business world. These are the new Luddites and, given half a chance, they would smash the machine to pieces." Behind The Bunker is a company called AL Digital Communications, established by the brothers Adam and Ben Laurie and Dominic Hawken. "The AL Digital team made a sealed bid - still secret, according to the Ministry of Defence - and the 60,000sq ft bunker with 18 acres of land was theirs," writes Boggan. There are three back-up power systems big enough to fire up a small town. There is also a fire station, vast underground fuel and water tanks and an array of cameras on corridors and servers. "You have to understand. Future wars will be fought by capitalists and anti-capitalists as society polarises," Professor Angell is reported as saying. "When that happens, control of information will be as important as control of territory used to be in conventional conflicts. If you can stop your enemy from destroying your information, then you have a good chance of winning the war." __________________________________________________________________________ Distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. --- ************************************************************************** Subscribe to Freematt's Alerts: Pro-Individual Rights Issues Send a blank message to: freematt(a)coil.com with the words subscribe FA on the subject line. List is private and moderated (7-30 messages per week) Matthew Gaylor, (614) 313-5722 ICQ: 106212065 Archived at http://groups.yahoo.com/group/fa/ **************************************************************************

1 0

[serval-project-dev] Africa's mobile economic revolution | Technology | The Observer
by Romana Challans 05 Jul '18

05 Jul '18

http://www.guardian.co.uk/technology/2011/jul/24/mobile-phones-africa-micro… -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To post to this group, send email to serval-project-developers(a)googlegroups.com. To unsubscribe from this group, send email to serval-project-developers+unsubscribe(a)googlegroups.com. For more options, visit this group at http://groups.google.com/group/serval-project-developers?hl=en. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] 'bullet proof' hosting
by Eric King 05 Jul '18

05 Jul '18

Beware of some of the lawful access regimes in Europe - particularly Sweden. The powers granted under their FRA law were only curtailed at the last moment, and it still isn't brilliant. There were a number of government bills in 2006 that extended the use of secret surveillance, including inter alia a bill to allow telephone tapping for preventive reasons as well as bugging of conversations with the help of hidden microphones. On 31 May 2006 the Parliament decided to postpone discussion on the bill for at least a year and "insisted that safeguards against abuse of power be introduced into the bill, including an obligation for police to inform those subject to secret surveillance whenever this is considered safe for investigative reasons."[66] In 2007, a proposed bill would allow the National Defence Radio Establishment (FC6rsvarets Radioanstalt, FRA) permission to use data mining software to search for sensitive keywords in all phone and email communications passing through cables or wires across the country's borders without a court order.[67]Until then the FRA could only listen to radio transmissions and did not have the authority to monitor and analyse Internet data traffic.[68] The FRA would need approval from a parliamentary committee on military intelligence affairs and would only be permitted to "tap into communications through pattern analysis and key word searches, and would not be entitled to target specific individuals."[69] Before this bill was approved on 18 June 2008, such traffic could only be monitored with court approval if police suspected a crime, although the agency was free to spy on airborne signals, such as radio and satellite traffic. The new legislation became widely controversial and has posed a threat to cross-border communications.[70]It allows for the interception of e-mail, telephone and faxes, and is therefore a threat to anyone dealing with a Swedish organisation.[71] Even where domestic Internet communication is intended for two persons residing in Sweden, the same information may cross national borders through Germany, Denmark, and the USA.[72] The implication is that people residing outside of Sweden, as well as Swedes, may be subject to the surveillance of FRA.[73] The FRA wiretapping law adopted on 18 June 2008 consists of four statutes: a newly adopted statute on signals intelligence and changes in three other statutes.[74] "FRA has a mandate to search for 'external threatsb, which involves everything from military threats, terrorism, IT security, supply problems, ecological imbalances, ethnic and religious conflicts, and migration to economic challenges in the form of currency and interest speculation."[75] Causing further controversy is the lack of any requirement that the FRA should have a reason to suspect crime or need a court order before being allowed to conduct surveillance of Swedish residents.[76] After criticism by privacy groups and a massive public debate about such sweeping powers, the Act was amended.[77] In addition, "a legal complaint has been made to the EU in July about this Act's possible breach of the EU's privacy and discrimination law with regard to cross-border legal consultations."[78]The European Commission, who would have to bring formal infringement procedures against Sweden, has not yet made any such action.[79] The law was supposed to enter into force by January 2009 but after the massive debacle surrounding the issue in Sweden, the government proposed a modified bill that included a number of privacy improvements to the original legislation. Among other aspects, the details of FRA monitoring are now subject to political scrutiny and the FRA must seek permissions for every search made. The amendment was approved by the Parliament on 14 October 2009 and the new, restricted competences of the FRA came into force on 1 December of the same year.[80] As of September 2010, the FRA has still to initiate its surveillance scheme. Technical problems regarding access points as well as resistance from some Internet service providers have allegedly delayed the actual surveillance from starting. https://www.privacyinternational.org/article/sweden-privacy-profile Eric On 24 Aug 2011, at 00:27, Moritz Bartl wrote: > On 23.08.2011 21:11, Miles Fidelman wrote: >>> With this in mind, can anyone suggest any methods for 'bullet proof' >>> hosting that functions under a jurisdiction that upholds freedom of >>> expression in ways that don't lead to such 'take down' notices? >> The obvious strategy is to mirror on multiple hosts in different >> jurisdictions, and make sure that domain registration and nameservice is >> in a country that values freedom of expression (or is spammer friendly). > > I agree. > > It is best to approach potential hosters up front with a description of > the project and worst case scenarios/attacks (complaints, takedown > notices, etc). Sweden and the Netherlands were mentioned to have pretty > good privacy laws, and for most cases it is not necessary to go with > advertised "bullet proof" ISPs such as PRQ, which in general are very > pricey. Iceland is even more expensive. Another well known decent > privacy ISP for example is shinjiru in Malaysia ( > http://www.shinjiru.com/ ). If you need more detailed recommendations, I > can compile a larger list of potential ISPs to contact, but again, it > should not be hard to find 2-3 good ISPs in different jurisdictions > willing to stand some heat. > > -- > Moritz Bartl > https://www.torservers.net/ > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" > > You will need the user name and password you receive from the list moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech > _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Roger's status report, May 2012
by Roger Dingledine 05 Jul '18

05 Jul '18

Hi folks! As the Tor Project has grown in scope, we've been struggling to keep up with simultaneously a) doing all the development that needs to be done (including meeting deliverables for our funders), and b) keeping the community up-to-date on our in-progress work. Lately I've been writing monthly status summaries, much like what we have our GSoC students do. In an effort to be more transparent, I'm going to start sending them to tor-talk rather than just to the other developers. Note that I will need to omit or anonymize things sometimes -- some research groups I meet with don't want to announce their paper draft until it gets accepted at a conference, some funders don't want the publicity that would come from admitting their interest in Internet freedom, etc. I'll try to err on the side of sunlight though. For those here who are totally taken by surprise by this email (and the fact that Tor does things :), I encourage you to to lurk on the irc channels if you want to follow along more closely. https://www.torproject.org/about/contact#irc And finally, please do ask questions! Here's your chance to understand my role in Tor and how it fits with what other people are doing. But since the root of the problem here has been that we do too many things and don't have time to do more, please focus on your most burning question(s). --Roger ------------------------------------------------------------------------ Here's what I said at the beginning of May that I hoped to do: > - Allocate FOCI papers to reviewers. Done. We got 20 submissions, and reviewing is ongoing. We'll pick some in early June. https://blog.torproject.org/blog/call-papers-free-and-open-communications-i… https://www.usenix.org/conference/foci12/ > - Actually release 0.2.2.36, this time for sure, no take-backs. Done. https://lists.torproject.org/pipermail/tor-announce/2012-June/000084.html > - Help Radu put in the NIST proposal. Done. We submitted a grant proposal to work with a team of research institutions on questions around privacy, identity, and mobile. I'll write more details here if the grant agency turns out to like the proposal. > - Help Nick and Mike interview and make decisions about core developers. Done (well, mostly they did it). https://blog.torproject.org/blog/dedicated-core-tor-developer https://www.torproject.org/about/jobs-coredev.html.en Our new core developer is getting up to speed now. I'm really excited that this will mean Nick can make more progress on core development! I'll let them make a further announcement when they're ready. > - I'm going to try to be absent from the world May 11-15. Done (vacation). > - May 14 is the PETS stipend deadline. After that I'll help Andrei > allocate the stipends. The PETS people wanted us to push the deadline back to June 1. I dealt with all the mails and allocated stipends in early June. http://petsymposium.org/2012/stipends http://petsymposium.org/2012/ > - Get the PETS papers up on the PETS website. They're up at http://freehaven.net/anonbib/papers/pets2012/ and I will add links to http://petsymposium.org/2012/program.php but I'm doing a cursory check with Matt first to see if he knows whether any authors want to keep their papers unpublished for now. > - Launch a working-group of pluggable transport developers and > researchers, and make sure they all know about each other. Not done. I'll aim to get a pluggable transport development page up on the website in June. > - Try to help vmon and Zack Weinberg feel more accepted in the > community, since I'm the backup mentor for vmon's gsoc project. Ongoing. We succeeded at getting the Stegotorus code approved for publication by Zack's funders, so vmon's gsoc project can proceed as planned. You can read vmon's periodic status reports on the tor-dev mailing list. Next step is to help get the Stegotorus git repository cleaned up, make the code itself more functional, and encourage them to make a tech report version of the paper available. https://gitweb.torproject.org/stegotorus.git > - Flesh out more SponsorZ tasks so we're more aware of our future. Not finished. But you can follow along on our current "I wish we had a funder for this task so we could spend time on it" task list: https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorZ > - Help SponsorF come up with metrics by which the SponsorF Red Team > will judge the project's success. Not done. I expect more progress in June though -- stay tuned. > - Rewrite the "how governments and military use Tor" section on the > webpage, since they actually don't run hidden services to our knowledge, > but we do have good new stories like IWF's use of Tor. Not done. More generally, I wish I had some extra weeks to sit down and update the FAQ and other web pages, since it's been years since I wrote many of them. > - I'm going to Oakland Done. http://www.ieee-security.org/TC/SP2012/ I talked to a bunch of people, such as - Micah Sherr, professor at Georgetown, who wants to help us with ExperimenTor and simulation bugs. I will send him a pile of trac ticket links around our recent performance simulation problems. https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/Performance http://crysp.uwaterloo.ca/software/exptor/ - Rob Cunningham who is Kevin Bauer's new boss. I spent a while trying to convince Rob that he should have Kevin work on Tor simulation and performance questions as part of his new job at Lincoln Labs. http://www.mit.edu/~ke23793/ - Camilo Viecco, who now works for Mozilla on adding privacy features to Firefox. He has been frustrated so far at getting his commits in: he has buy-in from the security team, but other teams block his commits with statements like "it's an arms race we can't win, so don't even bother trying to make things better". I encouraged him to get his mid-level manager to play the politics game better on his behalf. - Tariq Elahi, Ryan Henry, and Tao Wang are grad students from Ian's group doing interesting things: http://crysp.uwaterloo.ca/ In particular Tariq is working on a paper showing that we shouldn't replace guards in our list as soon as they go away, since it significantly increases the exposure to other guards. I helped Tariq quite a bit with his paper. http://cacr.uwaterloo.ca/techreports/2012/cacr2012-11.pdf But Ryan is working on privacy-preserving ways to gather Tor statistics data, and I don't have time to help him figure out what most needs collecting. Please jump in if you're interested. http://www.cs.uwaterloo.ca/~rhenry/pdf/torstat-poster-Oakland.pdf - I talked to several anonymous communications professors about having them use their sabbatical to become the Tor research coordinator. What we need to replace me as research coordinator is not a grad student -- we need someone who already knows how to set a research agenda and get other people to do it, i.e. a professor. Several are going on sabbatical soon, and we could supplement their salary for cheap. - I spoke at length with the authors of the "Peekaboo" and "LasTor" papers, and somewhat less with the LAP authors. I'll publish some paper analyses and summaries on the blog as I get time. http://freehaven.net/anonbib/#oakland2012-peekaboo http://freehaven.net/anonbib/#oakland2012-lastor http://freehaven.net/anonbib/#oakland2012-lap > - I'll aim to drop by SponsorF and/or Stanford at the end of the month > to give them some facetime. I met with Zack Weinberg and Jeroen Massar. I've been working with Zack to kick SponsorF into making the Stegotorus code available. I think it will benefit a lot from the light of day -- we've already discovered a lot of usability issues. I fear that key parts of the underlying design (like, say, the Stego part) are going to need to be discarded though. Jeroen is working on their "get lots of bridge addresses and handle routing traffic through them at the iptables layer" design. They're also working on a program to take in a blob (e.g. from bridgedb), do some network interactions, and produce a bridge address -- see also item 7 on https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorF/Year2 I expect that I'm going to have to wrestle them to the ground to make it open before we can find out if it will be of any use to us or the world. The wrestling will continue at the upcoming SponsorF meeting in June. Also stay tuned for their FOCI paper describing the overall architecture. I also met with David Fifield, the Flashproxy developer (grad student at Stanford, and an nmap developer). I now believe that Flashproxy is ready for further deployment and use by real users. The main drawback is that the censored users currently need to have a public IP address (i.e. not be behind a NAT) to use it. I expect as websockets tries harder to replace Skype, it will be easier for us to do nat piercing inside the browser and resolve this limitation. https://gitweb.torproject.org/flashproxy.git/blob/HEAD:/README http://crypto.stanford.edu/flashproxy/ http://crypto.stanford.edu/flashproxy/flashproxy.pdf At the upcoming developer meeting in Florence, we should have a discussion about all these great people doing great work for Tor that aren't hearing our status report discussions currently. Maybe I should contribute to the solution by putting my monthly status reports on the blog or on tor-talk. ------------------------------------------------------------------------ Here are some other things I did in May: - Met with two of Rachel Greenstadt's grad students at Drexel University who want to do their class project on Tor after seeing our Berlin 28C3 talk. They had wanted to try to measure linkability between exiting streams on a given circuit. I encouraged them instead to work on https://trac.torproject.org/projects/tor/ticket/5752 and in particular https://trac.torproject.org/projects/tor/ticket/5830 - Talked to Nick Feamster at Georgia Tech (soon to be University of Maryland) about OONI vs his Bismark project. He doesn't think his Bismark devices are big enough to handle Python, so he's been writing his tests in lua. I suggested that OONI and Bismark should at least share a common output format. I think Arturo is right to keep asking him "Are you sure your devices can't run python? Really sure?" http://projectbismark.net/ http://ooni.nu/index.html - Continued to put time into moderating and responding to blog comments. They've turned into a great source of real bugs, especially among Windows users. Let me reiterate my hopes for a forum where we can turn these people into more of a community. If only secure maintainable forum software existed in the world. [Update: one of our new funders has included funding to get some forums up and running and maintained -- I'm not sure on the timeframe for it yet though.] https://blog.torproject.org/ - Turned down an IEEE TDSC academic journal review request, and an IEEE ToN journal review request, because of IEEE's anti-science publishing policy. http://www.researchwithoutwalls.org/ - Our CSET submission comparing Shadow to ExperimenTor got accepted! Details (including a camera-ready version) coming soon. https://www.usenix.org/conference/cset12 ------------------------------------------------------------------------ Here are some items I expect to do in June: - Participate in the Q2 Tor directors board meeting, including approving the updated 2012 budget. - Understand the open positions in our current budget, what funders each one maps to, and what the priorities are in terms of spending the money. Then we can start putting some calls-for-resumes-and-code-samples up on the website, as well as prioritizing which calls we want to do when. Unless I ignore all of this until July. - Get 0.2.3.16-alpha out. Get 0.2.2.37 out. Get 0.2.3.17-alpha out. - Orchestrate the FOCI discussion and select the program. - Tell Micah Sherr and Chris Wacek (Georgetown) about the open simulation questions; and get Rob Jansen (UMN/NRL), Mashael AlSabah (Waterloo), etc a good summary of the current situation. - Read and consider http://microsoftjobsblog.com/zen-of-pm so I can help Adam Shostack help us get a good project manager. - I have a three hour slot at the SponsorF meeting this month. I'm going to try to bring everybody there up to speed on everything. While also letting other people talk for most of the time. Preparing for this talk will be a big part of my June. - Meet with Kevin Dyer's lab at Portland State before the SponsorF meeting. Rob Jansen and Aaron Johnson (NRL) will be joining me. - Help prepare for the SponsorF site visit that will occur a few days before PETS. We'll need to provide slides/etc, and likely even call in and do the phone presentation thing. - Go to Stamford CT to do a Tor talk for one of Ian's past students. http://privacyandsecurity.pbiresearch.com/agenda.html - Write an abstract for the ecrypt talk I'm doing at the workshop before PETS: https://www.cosic.esat.kuleuven.be/ecrypt/provpriv2012/invited.html - Fly to Florence, for the Tor developers meeting and hackfest in July. https://trac.torproject.org/projects/tor/wiki/org/meetings/2012SummerDevMee… https://trac.torproject.org/projects/tor/wiki/org/meetings/2012FlorenceHack… ------------------------------------------------------------------------ Things I'm still dropping the ball on: - I wonder if I should follow up with Carol @ google about our obfsproxy post in February and the interest they expressed in doing a repost on the gsoc blog. https://blog.torproject.org/blog/obfsproxy-next-step-censorship-arms-race http://google-opensource.blogspot.com/ - Transparently document the secteam process, especially since we have concluded to use it far less often and only for critical security things. - Answer the thread between Karsten and Jake where we had an excited volunteer with a clearly useful contribution that we totally dropped on the floor. Try to generalize the experience to improve our response to new contributors. We used to be great at it, and lately we're all overloaded. - Add a "scientific papers" exception to our trademark-faq: I want to give blanket permission to scientific papers to use the word Tor in their paper name, so long as they don't go and write software under that name too. https://www.torproject.org/docs/trademark-faq - Make a plan for fixing all the "CBT sometimes breaks Tor" issues. https://trac.torproject.org/projects/tor/ticket/3443 - Try to teach the Virtus Linux guy about how to make a safe Tor distro. http://sourceforge.net/projects/virtuslinux/ - Start summarizing Tor research papers on the blog more regularly. There have been a huge number of really important research papers lately, and most Tor people don't know about them. Should I summarize them on the blog (for a broader audience), or on tor-dev (for the rest of the Tor developers), or what? - Add Zack Weinberg, David Fifield, etc to tor-assistants, so they can be more integrated into the community. And then to tor-internal. And then dissolve tor-internal and make us all be transparent again. - Figure out where we are on the "change our cipher suite" tickets, and try to help them move forward. https://trac.torproject.org/projects/tor/ticket/4744 - I need new business cards. - Get https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorA through D back up on the wiki somewhere (Andrew took them down since they were concluded, and since they just listed contract deliverables rather than the progress reports and trac ticket links that we've been doing for later funders; but we should keep them there for posterity). _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Tragic News: Aaron Swartz commits suicide
by Kate Krauss 05 Jul '18

05 Jul '18

A note from the president of MIT: To the members of the MIT community: Yesterday we received the shocking and terrible news that on Friday in New York, Aaron Swartz, a gifted young man well known and admired by many in the MIT community, took his own life. With this tragedy, his family and his friends suffered an inexpressible loss, and we offer our most profound condolences. Even for those of us who did not know Aaron, the trail of his brief life shines with his brilliant creativity and idealism. Although Aaron had no formal affiliation with MIT, I am writing to you now because he was beloved by many members of our community and because MIT played a role in the legal struggles that began for him in 2011. I want to express very clearly that I and all of us at MIT are extremely saddened by the death of this promising young man who touched the lives of so many. It pains me to think that MIT played any role in a series of events that have ended in tragedy. I will not attempt to summarize here the complex events of the past two years. Now is a time for everyone involved to reflect on their actions, and that includes all of us at MIT. I have asked Professor Hal Abelson to lead a thorough analysis of MIT's involvement from the time that we first perceived unusual activity on our network in fall 2010 up to the present. I have asked that this analysis describe the options MIT had and the decisions MIT made, in order to understand and to learn from the actions MIT took. I will share the report with the MIT community when I receive it. I hope we will all reach out to those members of our community we know who may have been affected by Aaron's death. As always, MIT Medical is available to provide expert counseling, but there is no substitute for personal understanding and support. With sorrow and deep sympathy, L. Rafael Reif - *VIA* -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Chromebooks for Risky Situations?
by Meredith L. Patterson 05 Jul '18

05 Jul '18

seL4 has had readily available code for quite some time now, although it's under a tl;dr "Non-Commercial License Agreement" that differentiates itself from open source. http://ertos.nicta.com.au/software/seL4/home.pyl It's unfortunate, but it's also par for the course with a lot of academic code. The article does make it sound like a better license is coming, though. I'm not surprised that DARPA was first in line for a productized verified microkernel. Software verification has been a high priority for DoD since there was software -- it's why the Ada programming language was developed in the first place. Turns out nobody likes programming in Ada if they can help it, so DoD is turning to academia and industry to satisfy the need for verifiability. (Full disclosure: one of my projects is currently funded under the DARPA Cyber Fast Track program, and is GPLv2. The software I'm producing is related to verifiability, and could in fact be used to help secure drones -- but it can also be used to help secure web servers, end-user applications, pretty much any software that talks to other software. seL4 is even more generally useful than that.) The good news about a verified microkernel, at least, is that you *can* be assured of whether there's a backdoor in it. (Provided you, or someone, are able to express that as a formal property and verify it with a [machine-assisted] proof, that is. I think it's reasonable to expect the developers of said kernel to provide that proof.) Cheers, --mlp On Wed, Feb 13, 2013 at 9:38 AM, Gregory Foster <gfoster(a)entersection.org> wrote: > Incidentally, NICTA are the same researchers hired by DARPA to make the U.S. > drone fleet safe from hackers. Looks like there might be some open source > tools emerging from the effort. > http://www.theregister.co.uk/2012/11/19/nicta_develops_drone_protection/ > > gf > > > > On 2/13/13 6:54 AM, Eugen Leitl wrote: >> >> On Tue, Feb 12, 2013 at 09:01:37AM +0100, Andreas Bader wrote: >> >>> So why not create a own OS that is really small because of its security? >>> Chrome OS is small because it's cheap. If you were right then Android >>> was the most secure system. Aren't there any Android viruses? RedHat >>> seems to have less security holes than Chrome OS. >> >> http://ertos.nicta.com.au/research/l4.verified/ >> >> The L4.verified project >> >> A Formally Correct Operating System Kernel >> >> In current software practice it is widely accepted that software will >> always have problems and that we will just have to live with the fact that >> it may crash at the worst possible moment: You might be on a deadline. Or, >> much scarier, you might be on a plane and there's a problem with the board >> computer. >> >> Now think what we constantly want from software: more features, better >> performance, cheaper prices. And we want it everywhere: in mobile phones, >> cars, planes, critical infrastructure, defense systems. >> >> What do we get? Mobile phones that can be hacked by SMS. Cars that have >> more software problems than mechanical ones. Planes where computer problems >> have lead to serious incidents. Computer viruses spreading through critical >> infrastructure control systems and defense systems. And we think "See, it >> happens to everybody." >> >> It does not have to be that way. Imagine your company is commissioning a >> new vending software. Imagine you write down in a contract precisely what >> the software is supposed to do. And then b it does. Always. And the >> developers can prove it to you b with an actual mathematical machine-checked >> proof. >> >> Of course, the issue of software security and reliability is bigger than >> just the software itself and involves more than developers making >> implementation mistakes. In the contract, you might have said something you >> didn't mean (if you are in a relationship, you might have come across that >> problem). Or you might have meant something you didn't say and the proof is >> therefore based on assumptions that don't apply to your situation. Or you >> haven't thought of everything you need (ever went shopping?). In these >> cases, there will still be problems, but at least you know where the problem >> is not: with the developers. Eliminating the whole issue of implementation >> mistakes would be a huge step towards more reliable and more secure systems. >> >> Sounds like science fiction? >> >> The L4.verified project demonstrates that such contracts and proofs can be >> done for real-world software. Software of limited size, but real and >> critical. >> >> We chose an operating system kernel to demonstrate this: seL4. It is a >> small, 3rd generation high-performance microkernel with about 8,700 lines of >> C code. Such microkernels are the critical core component of modern embedded >> systems architectures. They are the piece of software that has the most >> privileged access to hardware and regulates access to that hardware for the >> rest of the system. If you have a modern smart-phone, your phone might be >> running a microkernel quite similar to seL4: OKL4 from Open Kernel Labs. >> >> We prove that seL4 implements its contract: an abstract, mathematical >> specification of what it is supposed to do. >> >> Current status: completed successfully. >> >> Availablility >> >> Binaries of seL4 on ARM and x86 architectures are available for academic >> research and education use. The release additionally contains the seL4 >> formal specification, user-level libraries and sample code, and a >> para-virtualised Linux (x86) >> >> Click here to download seL4 >> >> More information: >> >> What we prove and what we assume (high level, some technical background >> assumed) >> Statistics (sizes, numbers, lines of code) >> Questions and answers (high-level, some technical background assumed) >> Verification approach (for technical audience) >> Scientific publications (for experts) >> Acknowledgements and team >> What does a formal proof look like? [pdf] >> Contact >> >> For further information, please contact Gerwin Klein (project leader): >> gerwin.klein(at)nicta.com.au > > > -- > Gregory Foster || gfoster(a)entersection.org > @gregoryfoster <> http://entersection.com/ > > > -- > Unsubscribe, change to digest, or change password at: > https://mailman.stanford.edu/mailman/listinfo/liberationtech -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0