July 2018 - cypherpunks-legacy

FC: Debate over warrantless Carnivore bill with Stu Baker
by Declan McCullagh 06 Jul '18

06 Jul '18

Stewart Baker is the former general counsel to the National Security Agency and now a partner at the Washington law firm of Steptoe and Johnson: http://www.steptoe.com/WebBio.nsf/biographies/Stewart+A.+Baker?OpenDocument http://www.mccullagh.org/image/10/stewart-baker.html Below is a few rounds of a debate we had on Dave Farber's IP list in response to my article ("Senate votes to permit warrantless Net-wiretaps, Carnivore use"): http://www.wired.com/news/politics/0,1283,46852,00.html -Declan ********** >To: "'farber(a)cis.upenn.edu'" <farber(a)cis.upenn.edu> >cc: "Albertazzie, Sally" <SAlbertazzie(a)steptoe.com> >Subject: RE: Senate votes to permit warrantless Net-wiretaps, Carnivore > us e >Date: Fri, 14 Sep 2001 19:28:17 -0400 > >This seems a bit alarmist. The FBI has long had the authority to get the >phone numbers that are called from or that call to a suspect's phone. These >are trap-and-trace and pen-register orders. The Justice Department has >generally taken the position that the Internet equivalent of such data is >the addressing information in emails. This bill would enshrine the Justice >Department position in law -- without changing the warrant requirements or >the predicate for getting such Internet pen register data. It's not that >big a change from the status quo. I would guess that, even without the law, >Justice would have about a 60-40 or even 70-30 chance of winning its >argument in court. > >In my view there are some reasons to be uneasy about the bill but not >frothing. > >First, the to and from lines on my emails (plus the URLs I visit) are in >fact more intimate information than the phone numbers I call. What's more, >I'm already on notice that the phone numbers aren't all that private -- >they're used to bill me, after all. Not true for URLs or "to" lines. Once >that data is gathered by the police(on a very easy standard, I agree), it >may never be thrown out, and lots of people can access it. So extending >police authority to such data ought to be the occasion for thinking >creatively about how to discipline the use of that authority. If I were >writing the bill, I'd let the police gather such data, but I'd do more to >audit the people who access it and require prosecutors to notify people >after the fact that they've been targeted for surveillance (unless that >would blow an ongoing investigation). As things stand, the only people who >find out about such surveillance and thus get a chance to challenge it are >criminal defendants. Isn't that just backwards? I mean, who came up with a >system in which crooks may go free because their privacy was violated while >innocent people who've suffered the same violation never have a remedy? > >Second, most ISPs would like to see an assurance that Carnivore won't be >used if they have their own systems that can accomplish the same thing, or >that they'll be indemnified for any damage Carnivore might do to the system. > >In short, we may be missing some opportunities to improve privacy law, but >it's hard to say that the privacy sky is falling. > >Stewart **********

1 0

[Neuclear-general] ANNOUNCE: NeuClear XMLSig 0.13 Released
by Pelle Braendgaard 06 Jul '18

06 Jul '18

Panama City, 28th of April 2004. We are happy to announce the 0.13 release of NeuClear XMLSIG. Major new features are: * Support for Interactive signing * HTML Signatures For more info see: http://dev.neuclear.org/xmlsig/ For a quick usage introduction see the Busy Developers Guide at: http://dev.neuclear.org/xmlsig/bdg.html To try it out interactively run the following (Requires Java 1.4 or above with Java Web Start) http://dist.neuclear.org/app/neuclear-signer.jnlp -- http://talk.org + Live and direct from Panama http://neuclear.org + Clear it both ways with NeuClear ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Neuclear-general mailing list Neuclear-general(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/neuclear-general --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Endorse EDRI's Statement Against Data Retention
by brian-slashdotnews＠hyperreal.org 06 Jul '18

06 Jul '18

Link: http://slashdot.org/article.pl?sid=04/09/13/0128222 Posted by: timothy, on 2004-09-13 08:31:00 from the but-they're-offering-a-free-backup-service dept. [1]Ville Oksanen writes "Privacy International (PI) and European Digital Rights (EDRI) have published their [2]joint answer to [3]the consultation on mandatory data retention. The European Commission asked for public comments on a proposed retention regime across Europe between 12 and 36 months for all traffic data generated by using fixed and mobile telephony and Internet. As [4]Statewatch puts it: 'This is a proposal so intrusive that Ashcroft, Ridge and company can only dream about it, exceeding even the U.S. Patriot Act.' EDRI and PI are currently collecting endorsements from organizations and companies for their stamement [5]here. This is unfortunately not enough to stop the process - expecially more should be done in the member states, which ultimately decide the fate of the proposal. So contact your local politicians today!" [6]Click Here References 1. http://www.effi.org/ 2. http://www.privacyinternational.org/issues/terrorism/rpt/responsetoretention. html 3. http://europa.eu.int/information_society/topics/ecomm/useful_information/li… ary/public_consult/text_en.htm#data_retention 4. http://www.statewatch.org/ 5. http://www.edri.org/cgi-bin/index?id=000100000162 6. http://ads.osdn.com/?ad_id=5137&alloc_id=11055&site_id=1&request_id=9560795… p=click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [linux-elitists] Re: MCI boots send-safe (Register) -- adds a
by Karsten M. Self 06 Jul '18

06 Jul '18

net of 11 more spam hosts User-Agent: Mutt/1.5.6+20040907i on Thu, Mar 03, 2005 at 12:05:48PM -0500, Aaron Sherman (ajs(a)ajs.com) wrote: > On Wed, 2005-03-02 at 23:52, Karsten M. Self wrote: > > on Wed, Mar 02, 2005 at 06:16:38PM -0500, Aaron Sherman (ajs(a)ajs.com) wrote: > > > > Ok, I won't speak for Nick, but here's why I get all flustered about > > > this kind of thing: I have this nervous tick that forces me to imagine > > > how every "victory" in the war against X (drugs, spam, terrorism, you > > > name it) will, in turn, be used against me in future. > > > [...] > > I believe in a _balance_ of powers, a weighting on _merits_, and an > > avoidance of _extremes_. Large low-entropy pools are inherently > > dangerous. > > Interesting. I would not have thought to phrase it that way, but it's a > fair point. Thank you. > > _Those_ are the particulars of _this_ case. > > Yep, and I'm glad they've been booted, and I was over-reacting as a > result of a mis-reading. However, I defend the reaction in that, had the > root servers (or some subset) taken such unilateral action, I think it > would have been wildly inappropriate and would have set a frightening > precedent. The root servers situation is interesting and unclear. I haven't been referring to it. That said: if someone thumbs their nose at the world sufficiently long and hard, they shouldn't be too suprised to find the world thumbing back. Unconstrained, this does lead to breakdowns and opportunities for abuse (Joe-jobs, reputation trashing). I can't deny feeling a sense of karmic justice, however. > I know you may have come away from the previous discussion with the > sense that I have a desire to defend send-safe, but I assure you that > nothing could be farther from the truth. My feeling on the MCI policy > issue is that, worst-case, they should have amended their rules, > refunded send-safe's money and terminated the contract long ago. s/refunded.*money// ...particulary in the face of an AUP denying network abuse, spamming, etc. Send-safe were likely skating under the rules and were taking an overt business risk in doing so. > I do want to point out, though, that this means financial hardship for > MCI, ...my heart bleeds.... > which implies that some other company is going to be able to step > in to this market and make money by supporting the send-safes of the > world... get ready for the next phase of spam growth: the large, > international corporation that owns several ISPs and is entirely willing > to mix large pools of legitimate users, servers and networks in with > their spam services. Welcome to 1999, Aaron. Large ISPs have been doing this for years. Its one of the direct motives behind SPEWS. While emission-specific blocklists (SBL/XBL, SpamCop, etc.) track spam by source: SPEWS maintains a list of known spam sources and spam friendly hosts so that e-mail can be rejected from these problem sites. http://www.spews.org/ Track NANAE for a week and you'll see a litany of sob stories: "my IP is blocked by SPEWS, please delist me". No, your _hosting provider_ is listed by SPEWS. _They_ need to clean up their act. > You're going to NEED a real reputation system sometime soon, or spam > WILL become even more unmanageable than it is today. If you think IPV4 is bad, try IPV6. That's among the reasons I'm strongly promoting ASN/CIDR tracking: IPV6 aggregates that much more. Still, it's going to be problematic. There's the corrolary aspect that ever more traffic is going to be IP based. Currently it's email, web services, chat, and the like. Moving forward, it's going to be phone, IM, SMS, and more. What do you think the mean time between rings for, say, a high-score socioeconomic class areacode (202, 212, 415, 650, 312, 818) will be where long distance is free and Choicepoint household data floats freely on the Dark Net? And you _don't_ have realtime content/context data to filter in realtime audio. As for reputation systems: yeah, look at Senderbase / Iron Mountain. I see big things for them, particularly if they've got _any_ brains. > > > What if the complaints start originating from the MPAA or the US > > > government or the IMF or spammers? > > > > I don't particularly care where a complaint originates from. I _do_ > > care that the complaint is legitimate and valid. > > Also fair. I wonder though who writes the spec on those two terms? How about we judge based on community outrage ;-) > > > We're forcing them to evolve or die... what happens when that > > > evolution involves buying a very large ISP? Do we shut off half > > > the world or come up with a better plan? > > > > Do you connect your sewer mains to your spigots or your drains, > > Aaron? That's really a no-brainer. > > > So yes: if a large portion of the Net turns black, well, it turns > > black more ways than one. > > Your points about ASN/CIDR identification are good, but this last > statement bothers me. Plus, IPs are a poor metric. As we all know they > are ephemeral. I've had this discussion in the past week. IP ownership is ephemeral, particularly in dialup / dynamic access. ASN assignment is markedly less so, though they also change over time. What's markedly _less_ ephemeral are private blocklists. Remember, the public DNSBLs are just the visible tip of the iceberg. Private, site-specific lists, and dark lists, passed among friends and associates, but not made generally public, are legion. I used one such, with 65K+ domains, as part of my web content filtering for a youth center tech lab. Getting on and off public DNSBLs is _relatively_ sane. The lists have to be accountable to their users, and not violate either stated policy or useful effects too greatly, or they lose following. Within a private site, both usage patterns and propriety mean that once on, getting off a list is at best iffy. The result is that network abuse leads to a continuous erosion of useful IPs. Rotating abusive activity through a large block merely accelerates that process *and* provides a useful behavioral pattern identifying black-hat providers. > We *NEED* a reputation system that's based on strong encryption. Encryption without authentication _and_ reputation data is useless. The response time of such a system may be infeasible. And systems with weak authentication may work well: honeypots, web content, and other abuse monitors identifying specific IPs of interest. A watch that extends to a sensible range (say, a /24 initially, broader based on other heuristics). Local management of such lists means that defenses are continuously adapted to conditions. Hardwired whitelists for criticial contacts to avoid friendly fire losses. Hard-fail conditions to provide feedback to those who are inadvertantly blocked. It's not an ideal system. It's probably a 95% solution. And it doesn't rely on encryption at all. Sure: encryption and PKI are useful. I use and advocate their use. Uptake remains limited. And in large-volume processing, it's expensive. That said: opportunistic authentication _should_ be used and favored where it exists. > We have all of the tools (SMTP/TLS + CAs + DNS), we just need a single > protocol that at least a few large players agree to use that connects > them. Once that's in place, we could END spam. Yeah, sure. You want to split the profits? Since when do you trust CAs to identify nonspammers? What's this protocol you're talking about? How does it extend past email to _other_ forms of abuse? I see a handwave and "Profit!". I don't see a workable system yet. Care to expand? > Sure, there would be trade in stolen keys, but a decent system would > adapt (via the same mechanisms as DNSBLs) and repair quickly enough > that using a key would result in a return on investment insufficient > to warrant the effort in stealing it. Y'know, key repudiation _remains_ one of the weak points of current PKI. And the number of SSL sites lacking valid, authoritative, or other than non-self-signed keys is large. Plus the whole level of intermediation through browsers leads to _many_ user education issues. > New players who want to establish a rep would have to be "introduced" or > suffer most of their mail being black-holed until a sufficient > reputation had been established (perhaps years) How long does it take you to make friends? How long does it take you to _really_ trust someone? If there's such a reputation system, I'd like it to offer two features: - Love at first sight: the ability to decide, quickly, that yes, you pretty much do trust someone rather highly. - Disowning: Ok, so you've changed your mind (or have sufficient experience that you really ought to) about this relationship. Can you get a divorce? When I designed the K5 moderation and mojo systems, I built in two features: - Moderation should quickly reflect initial experiences. The first moderation counts most. Subsequent mods _can_ change the overall score, but it takes a lot of 'em to do much shifting. After a time, the message moderation tends to stabilize. - Mojo should weight recent activity. If someone's been long-term trustworthy, but suddenly gets all wiggly, three-year-old rep _really_ shouldn't count that much. > but let's face it: if you're deploying your own mail server then one > of the following is going to be true: > > * Your up-stream ISP approves and will vouch for you as a customer > who is under certain contractual obligations (not a guarantee of > validity, but a starting point) > * You know someone who trusts you and is willing to sign your key > (risking their own reputation). > * You are sending to a fair number of specific individuals who > will white-list you, slowly building your reputation. Under the scheme I envision, your relationship _largely_ is of concern to those with whom you're doing business. Basically: behave yourself the first time you come around. Eventually, you'll be considered a member of the family. Or at least given a neighborly greeting. Fortunately, most spammers currently exhibit such flagrant disregard for _any_ social niceties that you can write them off quickly. > Built properly, such a system would account for differing "opinions" > (e.g. many small businessmen in Russia seem to trust each other, even > though the rest of the world thinks they're evil... that's fine, they > have their view, we have ours). This is easily accomplished by doing > roughly what DNSBLs do: centering each origin of trust on a domain name, > and allowing any domain name to originate a new root of trust at any > time. Sounds complicated and my brain's not wrapping around this well ATM. There is the fundamental problem of trust transitivity. OTOH, if you use a weighting system in which you simply _correlate_ others' opinions with your own, you don't have to worry about agreement, you only need concern yourself with predictive value. That chap with whom you have _no_ common tastes is a perfect predictor: corrolation is -1. The useless data is the person with whom you're aligned half the time, corrolation 0. Authentication here is useful in that you're reasonably assured that the reputation is the one you think it is. Beyond that, you don't really need to trust it. > Nice things about this system are: the SPF problem goes away. You don't > care who initially started the chain, only who delivered it to your > front door. They have the power to vouch for bad-guys, but it will nuke > their rep. Your own relays would have a level of trust that puts your > central delivery host into a slave mode, so no reputation updates would > be performed (preventing your central MTA from harming your relay's > reputation when it passes you spam, and also reducing overhead). Right. I think I get at this somewhat more trivially with a proportionate rejection scheme: - Accept the first mail from a new source. - Rank that mail for spamminess. - Rinse, wash, repeat for some reasonable sample, over some aggregated netblock. You're going to find you're getting some proportion of spam vs. ham for that block. - Toss in curves for behavior: is the peer doing a dictionary attack on your space? Do they ignore temporary rejects, or not follow traditional retry intervals? Score goes down. - Based on the ratio of spam/ham coming from the site, at whatever granularity gives you a good statistical sample, say 10-30 datapoints per defined time period, where a week to a month should be more than sufficient, issue your own randomly assigned accept / reject responses. - Season to taste. > This might be rocket science, but it's not HARD rocket science. To the contrary, it's cooking with spam. Peace. -- Karsten M. Self <kmself(a)ix.netcom.com> http://kmself.home.netcom.com/ What Part of "Gestalt" don't you understand? A guide to GNU/Linux backups: http://kmself.home.netcom.com/Linux/FAQs/backups.html _______________________________________________ linux-elitists http://zgp.org/mailman/listinfo/linux-elitists ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [cryptography] Bitcoin-mining Botnets observed in the wild? (was: Re: Bitcoin in endgame
by Zooko Wilcox-O'Hearn 06 Jul '18

06 Jul '18

Folks: Here's a copy of a post I just made to my Google+ account about this alleged Botnet herder who has been answering questions about his operation on reddit: https://plus.google.com/108313527900507320366/posts/1oi1v7RxR1i === introduction === Someone is posting to reddit claiming to be a malware author, botnet operator, and that they use their Botnet to mine Bitcoin: B9. I asked them a question about the economics of using a Botnet for the Bitcoin distributed transaction-verification service ("Bitcoin mining"): B2. They haven't provided any proof of their claims, but on the other hand what they write and how they write it sounds plausible to me. === details === Here are my notes where I try to double-check their numbers and see if they make sense. They in their initial post B9 that they do 13-20 gigahashes/sec of work on the Bitcoin distributed transaction verification service. The screenshot they provided B3 shows 10.6 gigahashes/sec (GH/s) in progress, and that they're using a mining pool named BTCGuild. According to this chart of mining pools b4, BTCGuild currently totals about 12.5% of all known hashing power, and according to b5 the current total hashing power on the network is about 12.5 terahashes/sec (TH/s), so BTCGuild probably accounts for about 1.5 TH/s. They say that their Botnet has about 10,000 bots. The screen shot shows a count of "total bots" = 12,000 and "connected in the last 24 hours" = 3500. This ratio of total bots to bots connected in the last 24 hours is consistent with other reports I've read of Botnets b6, and also consistent with my experience in p2p networking. The number of "live bots" available at any one time for this Botnet herder should probably average out to somewhere between 350 and 550. Let's pick 500 as an easy number to work with. Does it makes sense that 500 bots could generate 10 GH/s? That's 20 MH/s per live bot. According to the Bitcoin wiki's page on mining hardware b7, a typical widely-available GPU should provide about 200 MH/s. Hm, so they are claiming only 1/10 the total hashpower that our back-of-the-envelope estimates would assign to them. Here is an answer they give to another person's question that sheds light on this: b8. Q: "Isn't Bitcoin mining pretty resource intensive on a computer? Like to the point someone would notice something is up on their system form it slowing eveyrthing down?" A: "My Botnet only mines if the computer is unused for 2 minutes and if the owner gets back it stops mining immidiatly, so it doesn't suck your fps at MW3. Also it mines as low priority so movies don't lag. I also set up a very safe threshold, the cards work at around 60% so they don't get overheated and the fans don't spin as crazy." It sounds plausible to me that those stealth measures could cut the throughput by 10 compared to running flat-out 24/7. Also it isn't clear if the botnet counts computers that don't have a GPU at all, or don't have a usable one. Maybe such computers are rare nowadays? Anyway if they are counted in there then that would be another reason why the hashing throughput per bot is lower than I calculated. In answer to another question B9b0, they said they get a steady $40/day from running the Bitcoin transaction-confirmation ("mining") service. According to this chart B9B9 from B9B2, the current U.S. Dollar value of Bitcoin mining is (or was a couple of days ago when they wrote that) about $0.33 per day for 100 MH/s. Multiplying that out by their claim of 10.6 GH/s results in $35/day. So that adds up, too. (Note that it sounds like their primary business is stealing and selling credit card numbers, and the Bitcoin transaction-verification service is a sideline.) I don't see a reason to doubt that they really generate about 10.6 GH/s of the Bitcoin distributed transaction verification service. My primary question is: if this is profitable on a per-bot basis, then why don't they scale up their operation? Of course, the answer to this presumably sheds light on the related question of why competitors of theirs don't launch similar operations. Perhaps one limiting factor is that the larger your Botnet, the more likely you'll be arrested by police or extorted by competitors. That may be a limiting factor that this person doesn't yet know about or doesn't like to think about. They mentioned b9 that most of their fellow cybercriminals are "too inexperienced to accept Bitcoin", so it may be that this person is just ahead of the curve and more people will launch operations like this in the future. That's the question that I asked them on redditbwhy don't they scale up? They haven't yet replied to my question, but they earlier mentioned in response to a different question b9: Q: "How many botted machines do you typically gain per month or per campaign." A: "about 500-1000 a day, weekends more. I'm thinking about just buying them in bulks and milking them for bitcoins. Asian installs are very cheap, 15$/1000 installs and have good GPUs." If they're really gaining 500 to 1000 new bots per day but they have a total of only 12,000 then either their operation is rapidly expanding, or the attrition rate is similarly high as the acquisition rate. === the bottom line and my take === I don't see any reason to doubt that this is real, and that this person with their Botnet is responsible for about 0.08% (i.e. less than 1/1000 b not 8%!) of the total Bitcoin distributed transaction-verification service, and that they profit for it at the rate of about $35 per day. There's one open question in my mind about whether this particular operator is currently rapidly expanding (adding 1000 bots per day to their network of 12,000 bots) or if the attrition rate of bots departing from the 12,000-node network is close to 1000 per day. If the $35/day revenue is really mostly profit (i.e., they don't have to spend so much time maintaining their 12,000-node Botnet that they forego more profitable activities, like stealing more credit cards or finishing their homework), I would expect them and others like them to turn more and more bots to this purpose. However, the nature of Bitcoin is that all providers of distributed transaction-confirmation service are in competition with one another. In the two weeks since this post went up on reddit, people around the globe deployed about 2 TH/s more hash power (see this graph of aggregate Bitcoin hash power b5), which cut the profitability of this one person's operation from $35.00/day to $30.00/day. If more and more Botnet operators get into the Bitcoin mining game, they will reduce the profitability of Bitcoin mining. (As well as competing with each other for access to victim computers, which has got to be a limited resources, right? Right? Or is there just a practically infinite supply of vulnerable computers waiting to be tapped if only someone can find a way to profit from them?) In parallel, the legitimate Bitcoin miners appear to be continuing to roll out new distributed transaction-verification service on their own hardware. Here is a recent post by "Bitcoinminer" about commercial Bitcoin farms based on GPU: B9B3. The operation spotlighted in that post apparently delivers 100 GH/s (about 10X that of our Botnet herder). At the same time, sales of FPGA-based Bitcoin devices appear to be booming. I wrote a post about that: B9b4. You'll have to scroll down through extensive discussion to find where I summarized the numbers, but in summary it appears that people are in the process of investing half a million USD in Bitcoin FPGA which, when all deployed, will deliver around 430 GH/s. I think there may be a kind of "Game of Chicken" going on: if someone makes a convincing show of investing in Bitcoin mining then they may deter other people from getting into the game and dividing up the profits. That may be the subtext of Bitcoinminer's blog postbhe may be trying to discourage competitors. An interesting thing about "Game of Chicken" is that large upfront costs can actually be an advantage because they demonstrate your commitment! If people are spending half a million dollars on FPGA Bitcoin miners, then their competitors had better believe they're really going to keep running them, even if competition drives down profitability. See, to deploy 10 GH/s of Bitcoin hash power using FPGA would require you to purchase about $10,000 worth of hardware which has no resell value except to other Bitcoin miners. To deploy 10 GH/s using GPU would require an outlay on about $5000 of hardware, which you could later resell for gaming (or whatever other uses GPUs have nowadays -- CAD/CAM?). To deploy 10 GH/s using a Botnet requires an unknown-to-me outlay of time, money, skill, or risk of personal harm, but at least the marginal cost of adding another few MH/s seems much lower than in the hardware-based approach. Our Botnet herder on reddit said he could buy access to Asian PCs with good GPUs for $15 for 1000 PCs. If that's true then it should cost a piddling $180 to set up a new network as big as his current 10 GH/s network. However, if he is considering doing something else with his time and money, then the fact that people have convincingly committed to large-scale FGPA mining may deter him, because no matter how well he does at competing with them, they've already paid a sunk cost, and their marginal cost for electricity is low, so they won't quit. (Unless competition swells to such a level that it drives revenue below their cost of electricity, which seems like a distant prospect at this point.) Thus they might win at the Game of Chicken and persuade him to spend his time and money on different projects (such stealing more credit cards or doing a better job on his homework). (There are also several organizations who are loudly proclaiming that they're developing custom ASIC chips for Bitcoin mining. I haven't yet seen hard evidence of any of them having really spent substantial money on it or having demonstrable progress on the engineering and manufacturing.) === last word === I'm delighted to see such vigorous and varied competition for contributing to the distributed, planet-wide transaction-confirmation service. I especially like the "sunk-cost" people such as the FPGA miners with their low electricity requirements, because they seem likely to be long-term, always-on contributors. B9 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B2 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B3 https://lafsgateway.zooko.com/file/URI:CHK:sdk72a5zmncihhmhdsremrglem:ez25w… b4 http://blockorigin.pfoe.be/chart.php b5 http://bitcoin.sipa.be b6 http://blog.damballa.com/?p=330 b7 https://en.bitcoin.it/wiki/Mining_Hardware_Comparison b8 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… b9 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B9b0 http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet… B9B9 http://bitcoinx.com/charts/chart_large_lin_30d.png B9B2 http://bitcoinx.com/charts/ B9B3 http://www.bitcoinminer.com/post/22769728108/commercial-mining-farms B9b4 https://plus.google.com/108313527900507320366/posts/2ztAhLnXQK _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] JAMES BAMFORD in Rolling Stone: The Man Who Sold the War.
by David Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: JAMES BAMFORD in Rolling Stone: The Man Who Sold the War. Date: Mon, 21 Nov 2005 21:10:16 -0800 From: geoff goodfellow <geoff(a)beat.net> To: farber(a)cis.upenn.edu The Man Who Sold the War Meet John Rendon, Bush's general in the propaganda war By JAMES BAMFORD RollingStone.com ... John Walter Rendon Jr. rises at 3 a.m. each morning after six hours of sleep, turns on his Apple computer and begins ingesting information -- overnight news reports, e-mail messages, foreign and domestic newspapers, and an assortment of government documents, many of them available only to those with the highest security clearance. According to Pentagon documents obtained by Rolling Stone, the Rendon Group is authorized "to research and analyze information classified up to Top Secret/SCI/SI/TK/G/HCS" -- an extraordinarily high level of clearance granted to only a handful of defense contractors. "SCI" stands for Sensitive Compartmented Information, data classified higher than Top Secret. "SI" is Special Intelligence, very secret communications intercepted by the National Security Agency. "TK" refers to Talent/Keyhole, code names for imagery from reconnaissance aircraft and spy satellites. "G" stands for Gamma (communications intercepts from extremely sensitive sources) and "HCS" means Humint Control System (information from a very sensitive human source). Taken together, the acronyms indicate that Rendon enjoys access to the most secret information from all three forms of intelligence collection: eavesdropping, imaging satellites and human spies. ... James Bamford is the best-selling author of "A Pretext for War: 9/11, Iraq, and the Abuse of America's Intelligence Agencies" (2004) and "Body of Secrets: Anatomy of the Ultra-Secret National Security Agency" (2001). This is his first article for Rolling Stone. http://www.rollingstone.com/politics/story/_/id/8798997 -- geoff djs beat.net to the bay area fridays noon to 3pm on kzsu 90.1 fm. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Diebold easily hacked
by Peter Jones 06 Jul '18

06 Jul '18

Dave - For IP, in case you had not seen this yet. The punchline: Secretary of State says the issue is between the election supervisor and Diebold. Apparently, hackable voting machines are not sufficient cause for concern to Florida's sterling electoral system. http://www.usatoday.com/news/nation/2005-12-15-opticalvoting_x.htm County says electronic voting machines can be hacked TALLAHASSEE, Fla. (AP) - Tests on an optical-scan voting system used around the country showed it is vulnerable to hacking that can change the outcome of races without leaving evidence of fraud, a county election supervisor said. The voting system maker, Diebold Inc., sent a letter in response that questioned the test results and said the test was "a very foolish and irresponsible act" that may violated licensing agreements. Company spokesman David Bear did not return a phone call from The Associated Press seeking comment Thursday. Diebold's letter was written by its senior lawyer, Michael Lindroos, and sent to the state of Florida, Leon County and the county election supervisor, Ion Sancho. Optical-scan machines use paper ballots where voters fill in bubbles to mark their candidates. The ballots are then fed into scanners that record the selections. In one of the tests conducted for Sancho and the non-profit election-monitoring group BlackBoxVoting.org, the researchers were able to get into the system easily, make the loser the winner and leave without a trace, said Herbert Thompson, who conducted the test. He also said the machine that tabulates the overall count asked for a user name and password, but didn't require it. In the other test, the researcher who had hacked into the voting machine's memory card was able to hide votes, make losers out of winners and leave no trace of the changes, said BlackBox founder Bev Harris. The memory card records the votes of one machine, then is taken to a central location where results are totaled. Sancho criticized the Florida Secretary of State's Office, which approves the voting systems used in the state, for not catching the alleged problems. A spokeswoman for the secretary of state's office said any faults Sancho found were between him and Diebold. "If Ion Sancho has security concerns with his system, he needs to discuss them with Diebold," spokeswoman Jenny Nash said. The Miami Herald reported Thursday that Sancho scraped Leon's Diebold machines this week for a voting system from another manufacturer. Many Florida counties switched to computer-based elections systems after the 2000 presidential election, when the cardboard punchcard ballots then in use were plagued by incomplete and multiple punches. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Diebold easily hacked
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[IP] JAMES BAMFORD in Rolling Stone: The Man Who Sold the War.
by David Farber 06 Jul '18

06 Jul '18

-------- Original Message -------- Subject: JAMES BAMFORD in Rolling Stone: The Man Who Sold the War. Date: Mon, 21 Nov 2005 21:10:16 -0800 From: geoff goodfellow <geoff(a)beat.net> To: farber(a)cis.upenn.edu The Man Who Sold the War Meet John Rendon, Bush's general in the propaganda war By JAMES BAMFORD RollingStone.com ... John Walter Rendon Jr. rises at 3 a.m. each morning after six hours of sleep, turns on his Apple computer and begins ingesting information -- overnight news reports, e-mail messages, foreign and domestic newspapers, and an assortment of government documents, many of them available only to those with the highest security clearance. According to Pentagon documents obtained by Rolling Stone, the Rendon Group is authorized "to research and analyze information classified up to Top Secret/SCI/SI/TK/G/HCS" -- an extraordinarily high level of clearance granted to only a handful of defense contractors. "SCI" stands for Sensitive Compartmented Information, data classified higher than Top Secret. "SI" is Special Intelligence, very secret communications intercepted by the National Security Agency. "TK" refers to Talent/Keyhole, code names for imagery from reconnaissance aircraft and spy satellites. "G" stands for Gamma (communications intercepts from extremely sensitive sources) and "HCS" means Humint Control System (information from a very sensitive human source). Taken together, the acronyms indicate that Rendon enjoys access to the most secret information from all three forms of intelligence collection: eavesdropping, imaging satellites and human spies. ... James Bamford is the best-selling author of "A Pretext for War: 9/11, Iraq, and the Abuse of America's Intelligence Agencies" (2004) and "Body of Secrets: Anatomy of the Ultra-Secret National Security Agency" (2001). This is his first article for Rolling Stone. http://www.rollingstone.com/politics/story/_/id/8798997 -- geoff djs beat.net to the bay area fridays noon to 3pm on kzsu 90.1 fm. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Diebold easily hacked
by Peter Jones 06 Jul '18

06 Jul '18

Dave - For IP, in case you had not seen this yet. The punchline: Secretary of State says the issue is between the election supervisor and Diebold. Apparently, hackable voting machines are not sufficient cause for concern to Florida's sterling electoral system. http://www.usatoday.com/news/nation/2005-12-15-opticalvoting_x.htm County says electronic voting machines can be hacked TALLAHASSEE, Fla. (AP) - Tests on an optical-scan voting system used around the country showed it is vulnerable to hacking that can change the outcome of races without leaving evidence of fraud, a county election supervisor said. The voting system maker, Diebold Inc., sent a letter in response that questioned the test results and said the test was "a very foolish and irresponsible act" that may violated licensing agreements. Company spokesman David Bear did not return a phone call from The Associated Press seeking comment Thursday. Diebold's letter was written by its senior lawyer, Michael Lindroos, and sent to the state of Florida, Leon County and the county election supervisor, Ion Sancho. Optical-scan machines use paper ballots where voters fill in bubbles to mark their candidates. The ballots are then fed into scanners that record the selections. In one of the tests conducted for Sancho and the non-profit election-monitoring group BlackBoxVoting.org, the researchers were able to get into the system easily, make the loser the winner and leave without a trace, said Herbert Thompson, who conducted the test. He also said the machine that tabulates the overall count asked for a user name and password, but didn't require it. In the other test, the researcher who had hacked into the voting machine's memory card was able to hide votes, make losers out of winners and leave no trace of the changes, said BlackBox founder Bev Harris. The memory card records the votes of one machine, then is taken to a central location where results are totaled. Sancho criticized the Florida Secretary of State's Office, which approves the voting systems used in the state, for not catching the alleged problems. A spokeswoman for the secretary of state's office said any faults Sancho found were between him and Diebold. "If Ion Sancho has security concerns with his system, he needs to discuss them with Diebold," spokeswoman Jenny Nash said. The Miami Herald reported Thursday that Sancho scraped Leon's Diebold machines this week for a voting system from another manufacturer. Many Florida counties switched to computer-based elections systems after the 2000 presidential election, when the cardboard punchcard ballots then in use were plagued by incomplete and multiple punches. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0