July 2018 - cypherpunks-legacy

None
by Peter Langston 06 Jul '18

06 Jul '18

... Subject: Live With the WikiLeakable World or Shut Down the Net. It's Your Choice Reply-To: psl(a)acm.org Organization: Mini Fun_People User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6 MiniFunPeople........................................ISSN 1098-7649 Forwarded-by: Peter Langston <MiniFunPeople(a)psl.to> http://www.commondreams.org/view/2010/12/06-9 /Published on Monday, December 6, 2010 by The Guardian UK/ *Live With the WikiLeakable World or Shut Down the Net. It's Your Choice* Western political elites obfuscate, lie and bluster b and when the veil of secrecy is lifted, they try to kill the messenger by John Naughton "Never waste a good crisis" used to be the catchphrase of the Obama team in the runup to the presidential election. In that spirit, let us see what we can learn from official reactions to the WikiLeaks revelations <http://www.guardian.co.uk/world/the-us-embassy-cables>. The most obvious lesson is that it represents the first really sustained confrontation between the established order and the culture of the internet. There have been skirmishes before, but this is the real thing. And as the backlash unfolds b first with deniable attacks on internet service providers hosting WikiLeaks <http://tinyurl.com/38h7xlr>, later with companies like Amazon and eBay and PayPal <http://www.bbc.co.uk/news/world-us-canada-11917891> suddenly "discovering" that their terms and conditions preclude them from offering services to WikiLeaks, and then with the US government attempting to intimidate Columbia students posting updates about WikiLeaks on Facebook b the intolerance of the old order is emerging from the rosy mist in which it has hitherto been obscured. The response has been vicious, co-ordinated and potentially comprehensive, and it contains hard lessons for everyone who cares about democracy and about the future of the net. There is a delicious irony in the fact that it is now the so-called liberal democracies that are clamouring to shut WikiLeaks down. Consider, for instance, how the views of the US administration have changed in just a year. On 21 January, secretary of state Hillary Clinton made a landmark speech about internet freedom, in Washington DC, which many people welcomed and most interpreted as a rebuke to China for its alleged cyberattack on Google. "Information has never been so free," declared Clinton. "Even in authoritarian countries, information networks are helping people discover new facts and making governments more accountable." She went on to relate how, during his visit to China in November 2009, Barack Obama had "defended the right of people to freely access information, and said that the more freely information flows the stronger societies become. He spoke about how access to information helps citizens to hold their governments accountable, generates new ideas, and encourages creativity." Given what we now know, that Clinton speech reads like a satirical masterpiece. One thing that might explain the official hysteria about the revelations is the way they expose how political elites in western democracies have been deceiving their electorates. The leaks make it abundantly clear not just that the US-Anglo-European adventure in Afghanistan is doomed but, more important, that the American, British and other Nato governments privately admit that too. The problem is that they cannot face their electorates b who also happen to be the taxpayers funding this folly b and tell them this. The leaked dispatches from the US ambassador to Afghanistan provide vivid confirmation that the Karzai regime is as corrupt and incompetent as the South Vietnamese regime in Saigon was when the US was propping it up in the 1970s. And they also make it clear that the US is as much a captive of that regime as it was in Vietnam. The WikiLeaks revelations expose the extent to which the US and its allies see no real prospect of turning Afghanistan into a viable state, let alone a functioning democracy. They show that there is no light at the end of this tunnel. But the political establishments in Washington, London and Brussels cannot bring themselves to admit this. Afghanistan is, in that sense, a quagmire in the same way that Vietnam was. The only differences are that the war is now being fought by non-conscripted troops and we are not carpet-bombing civilians. The attack of WikiLeaks also ought to be a wake-up call for anyone who has rosy fantasies about whose side cloud computing providers are on. These are firms like Google, Flickr, Facebook, Myspace and Amazon which host your blog or store your data on their servers somewhere on the internet, or which enable you to rent "virtual" computers b again located somewhere on the net. The terms and conditions under which they provide both "free" and paid-for services will always give them grounds for dropping your content if they deem it in their interests to do so. The moral is that you should not put your faith in cloud computing b one day it will rain on your parade. Look at the case of Amazon, which dropped WikiLeaks from its Elastic Compute Cloud <http://en.wikipedia.org/wiki/Amazon_Elastic_Compute_Cloud> the moment the going got rough. It seems that Joe Lieberman, a US senator who suffers from a terminal case of hubris, harassed the company over the matter. Later Lieberman declared grandly that he would be "asking Amazon about the extent of its relationship with WikiLeaks and what it and other web service providers will do in the future to ensure that their services are not used to distribute stolen, classified information". This led the New Yorker's Amy Davidson to ask <http://tinyurl.com/2akqw7z> whether "Lieberman feels that he, or any senator, can call in the company running the New Yorker's printing presses when we are preparing a story that includes leaked classified material, and tell it to stop us". What WikiLeaks is really exposing is the extent to which the western democratic system has been hollowed out. In the last decade its political elites have been shown to be incompetent (Ireland, the US and UK in not regulating banks); corrupt (all governments in relation to the arms trade); or recklessly militaristic (the US and UK in Iraq). And yet nowhere have they been called to account in any effective way. Instead they have obfuscated, lied or blustered their way through. And when, finally, the veil of secrecy is lifted, their reflex reaction is to kill the messenger. As Simon Jenkins put it recently <http://tinyurl.com/35lg6yv> in the Guardian, "Disclosure is messy and tests moral and legal boundaries. It is often irresponsible and usually embarrassing. But it is all that is left when regulation does nothing, politicians are cowed, lawyers fall silent and audit is polluted. Accountability can only default to disclosure." What we are hearing from the enraged officialdom of our democracies is mostly the petulant screaming of emperors whose clothes have been shredded by the net. Which brings us back to the larger significance of this controversy. The political elites of western democracies have discovered that the internet can be a thorn not just in the side of authoritarian regimes, but in their sides too. It has been comical watching them and their agencies stomp about the net like maddened, half-blind giants trying to whack a mole. It has been deeply worrying to watch terrified internet companies b with the exception of Twitter, so far b bending to their will. But politicians now face an agonising dilemma. The old, mole-whacking approach won't work. WikiLeaks does not depend only on web technology. Thousands of copies of those secret cables b and probably of much else besides b are out there, distributed by peer-to-peer technologies like BitTorrent <http://en.wikipedia.org/wiki/BitTorrent_%28protocol%29>. Our rulers have a choice to make: either they learn to live in a WikiLeakable world, with all that implies in terms of their future behaviour; or they shut down the internet. Over to them. _______________ B) Guardian News and Media Limited 2010 John Naughton is professor of the public understanding of technology at the Open University Article printed from www.CommonDreams.org URL to article: http://www.commondreams.org/view/2010/12/06-9 -- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

None
by Peter Langston 06 Jul '18

06 Jul '18

... Subject: Live With the WikiLeakable World or Shut Down the Net. It's Your Choice Reply-To: psl(a)acm.org Organization: Mini Fun_People User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6 MiniFunPeople........................................ISSN 1098-7649 Forwarded-by: Peter Langston <MiniFunPeople(a)psl.to> http://www.commondreams.org/view/2010/12/06-9 /Published on Monday, December 6, 2010 by The Guardian UK/ *Live With the WikiLeakable World or Shut Down the Net. It's Your Choice* Western political elites obfuscate, lie and bluster b and when the veil of secrecy is lifted, they try to kill the messenger by John Naughton "Never waste a good crisis" used to be the catchphrase of the Obama team in the runup to the presidential election. In that spirit, let us see what we can learn from official reactions to the WikiLeaks revelations <http://www.guardian.co.uk/world/the-us-embassy-cables>. The most obvious lesson is that it represents the first really sustained confrontation between the established order and the culture of the internet. There have been skirmishes before, but this is the real thing. And as the backlash unfolds b first with deniable attacks on internet service providers hosting WikiLeaks <http://tinyurl.com/38h7xlr>, later with companies like Amazon and eBay and PayPal <http://www.bbc.co.uk/news/world-us-canada-11917891> suddenly "discovering" that their terms and conditions preclude them from offering services to WikiLeaks, and then with the US government attempting to intimidate Columbia students posting updates about WikiLeaks on Facebook b the intolerance of the old order is emerging from the rosy mist in which it has hitherto been obscured. The response has been vicious, co-ordinated and potentially comprehensive, and it contains hard lessons for everyone who cares about democracy and about the future of the net. There is a delicious irony in the fact that it is now the so-called liberal democracies that are clamouring to shut WikiLeaks down. Consider, for instance, how the views of the US administration have changed in just a year. On 21 January, secretary of state Hillary Clinton made a landmark speech about internet freedom, in Washington DC, which many people welcomed and most interpreted as a rebuke to China for its alleged cyberattack on Google. "Information has never been so free," declared Clinton. "Even in authoritarian countries, information networks are helping people discover new facts and making governments more accountable." She went on to relate how, during his visit to China in November 2009, Barack Obama had "defended the right of people to freely access information, and said that the more freely information flows the stronger societies become. He spoke about how access to information helps citizens to hold their governments accountable, generates new ideas, and encourages creativity." Given what we now know, that Clinton speech reads like a satirical masterpiece. One thing that might explain the official hysteria about the revelations is the way they expose how political elites in western democracies have been deceiving their electorates. The leaks make it abundantly clear not just that the US-Anglo-European adventure in Afghanistan is doomed but, more important, that the American, British and other Nato governments privately admit that too. The problem is that they cannot face their electorates b who also happen to be the taxpayers funding this folly b and tell them this. The leaked dispatches from the US ambassador to Afghanistan provide vivid confirmation that the Karzai regime is as corrupt and incompetent as the South Vietnamese regime in Saigon was when the US was propping it up in the 1970s. And they also make it clear that the US is as much a captive of that regime as it was in Vietnam. The WikiLeaks revelations expose the extent to which the US and its allies see no real prospect of turning Afghanistan into a viable state, let alone a functioning democracy. They show that there is no light at the end of this tunnel. But the political establishments in Washington, London and Brussels cannot bring themselves to admit this. Afghanistan is, in that sense, a quagmire in the same way that Vietnam was. The only differences are that the war is now being fought by non-conscripted troops and we are not carpet-bombing civilians. The attack of WikiLeaks also ought to be a wake-up call for anyone who has rosy fantasies about whose side cloud computing providers are on. These are firms like Google, Flickr, Facebook, Myspace and Amazon which host your blog or store your data on their servers somewhere on the internet, or which enable you to rent "virtual" computers b again located somewhere on the net. The terms and conditions under which they provide both "free" and paid-for services will always give them grounds for dropping your content if they deem it in their interests to do so. The moral is that you should not put your faith in cloud computing b one day it will rain on your parade. Look at the case of Amazon, which dropped WikiLeaks from its Elastic Compute Cloud <http://en.wikipedia.org/wiki/Amazon_Elastic_Compute_Cloud> the moment the going got rough. It seems that Joe Lieberman, a US senator who suffers from a terminal case of hubris, harassed the company over the matter. Later Lieberman declared grandly that he would be "asking Amazon about the extent of its relationship with WikiLeaks and what it and other web service providers will do in the future to ensure that their services are not used to distribute stolen, classified information". This led the New Yorker's Amy Davidson to ask <http://tinyurl.com/2akqw7z> whether "Lieberman feels that he, or any senator, can call in the company running the New Yorker's printing presses when we are preparing a story that includes leaked classified material, and tell it to stop us". What WikiLeaks is really exposing is the extent to which the western democratic system has been hollowed out. In the last decade its political elites have been shown to be incompetent (Ireland, the US and UK in not regulating banks); corrupt (all governments in relation to the arms trade); or recklessly militaristic (the US and UK in Iraq). And yet nowhere have they been called to account in any effective way. Instead they have obfuscated, lied or blustered their way through. And when, finally, the veil of secrecy is lifted, their reflex reaction is to kill the messenger. As Simon Jenkins put it recently <http://tinyurl.com/35lg6yv> in the Guardian, "Disclosure is messy and tests moral and legal boundaries. It is often irresponsible and usually embarrassing. But it is all that is left when regulation does nothing, politicians are cowed, lawyers fall silent and audit is polluted. Accountability can only default to disclosure." What we are hearing from the enraged officialdom of our democracies is mostly the petulant screaming of emperors whose clothes have been shredded by the net. Which brings us back to the larger significance of this controversy. The political elites of western democracies have discovered that the internet can be a thorn not just in the side of authoritarian regimes, but in their sides too. It has been comical watching them and their agencies stomp about the net like maddened, half-blind giants trying to whack a mole. It has been deeply worrying to watch terrified internet companies b with the exception of Twitter, so far b bending to their will. But politicians now face an agonising dilemma. The old, mole-whacking approach won't work. WikiLeaks does not depend only on web technology. Thousands of copies of those secret cables b and probably of much else besides b are out there, distributed by peer-to-peer technologies like BitTorrent <http://en.wikipedia.org/wiki/BitTorrent_%28protocol%29>. Our rulers have a choice to make: either they learn to live in a WikiLeakable world, with all that implies in terms of their future behaviour; or they shut down the internet. Over to them. _______________ B) Guardian News and Media Limited 2010 John Naughton is professor of the public understanding of technology at the Open University Article printed from www.CommonDreams.org URL to article: http://www.commondreams.org/view/2010/12/06-9 -- ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[CCM-L] New tactical care teams aim to save more lives
by Eric Hodgson 06 Jul '18

06 Jul '18

Military expects TCCET teams to reduce combat mortality U.S. military planners hope to improve upon casualty survival rates by strengthening the capabilities of tactical critical care evacuation teams. TCCETs are trained and equipped to manage the most common causes for battlefield deaths such as uncontrolled bleeding, restricted airway and tension pneumothorax. <http://www.airforcetimes.com/news/2012/06/air-force-tactical- critical-evaluation-teams-060212w/> OR http://tinyurl.com/828vps8 _______________________________________________ CCM-L mailing list CCM-L(a)list.pitt.edu https://list.pitt.edu/mailman/listinfo/ccm-l ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Location tracking -- a bill of rights?
by Brian Smithson 06 Jul '18

06 Jul '18

[OK for IP if it's OK with you] Dave, I think Dennis' post about dodgeball gives a real life example of what I think should be the basic "Bill of Rights" for tracking devices. This is kind of rough, as I am making it up as I write. And pardon my wishful thinking :-). I. I should be informed of the existence of any tracking mechanism. This would include those which are integral to a product like in a cellphone, those which are deliberate add-ons like if "dodgeball" is an app I'm installing on my phone, and those which are embedded for some purpose unrelated to my own purpose like an RFID inventory- tracking tag in a sweater that I'm buying. Many people don't know that their phone can be used to track their location. Many more won't know that their *sweater* could be used to track their location. II. I should be able to turn the tracking function on and off. Of course, this may render the item useless, like a cellphone which can't communicate with its network. RFID companies won't like this one because RFIDs usually have no external controls and cost is a major factor in RFID adoption, so maybe it will be sufficient in some cases to simply be able to turn the function off (permanently). After I've bought the sweater, inventory tracking is no longer needed. III. I should be able to give explicit permission for trackers to track me for specific purposes. This would be like GLBA privacy laws, only let's try to make them actually work :-). So the cellphone carrier could track me, but only for the purpose of making the phone work unless I give them permission to do something else with that information. IV. I should be able to give permission through intermediaries. For example, I might want to give my cellphone carrier permission to give my tracking information to a third party for a particular purpose. This could have multiple levels, such as if (through a third party service, let's say dodgeball) I gave permission to Bob and Carol but denied it to Ted and Alice. V. I should own my tracking information. Those who facilitate tracking would have a "license" to the tracking data. I should be able to control how long it is retained by revoking that license. VI. Tracking facilitators are common carriers. Let's say I have a Verizon phone. If I want Verizon to make my tracking data available to another party, such a request should not be unreasonably refused. In other words, if I want Verizon to make my tracking data available to dodgeball, for example, they should not be able to refuse and insist that I use their social networking service instead. VII. I should be able to access records of who has been tracking me, when, and how. This may not be easy all the way to a personal level, but we should try. I can think of cases when I would want to know that on March 19th, Joe Blow at the phone company looked at my location records for the month of February. Or I might just want to know who location-enabled-spammed me when I had not given anyone permission to do that. VIII, IX, and X. I know there should be 10 rights, but I couldn't think of them. -- - Brian Smithson brian(a)grot.com ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Location tracking -- a bill of rights?
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[EMED-L] New York City Starts To Monitor Diabetics
by Steve Schecter 06 Jul '18

06 Jul '18

<EMED-L(a)ITSSRV1.UCSF.EDU> This is a little too much government for my liking thank you very much. By Rob Stein Washington Post Staff Writer Wednesday, January 11, 2006; Page A03 New York City is starting to monitor the blood sugar levels of its diabetic residents, marking the first time any government in the United States has begun tracking people with a chronic disease. Under the program, the city is requiring laboratories to report the results of blood sugar tests directly to the health department, which will use the data to study the disease and to prod doctors and patients when levels run too high. The unprecedented step is being hailed by many health experts as a bold attempt to improve care for diabetes, one of the nation's biggest medical problems, which is burgeoning into a crisis because of the aging population and the obesity epidemic. Some public health experts, ethicists and privacy advocates, however, say that the initiative raises serious concerns about confidentiality and is an alarming government intrusion into people's medical care. Both sides agree that the decision is probably a harbinger of a trend in which the government will apply tactics traditionally reserved primarily for infectious diseases to chronic conditions such as diabetes, heart disease, asthma and cancer, which have supplanted communicable illnesses as the most pressing public health concerns. "Because of the enormous number of people affected and the costs, chronic diseases have become the most prominent issue in public health," said Lawrence O. Gostin, who directs the Center for Law and the Public's Health at Georgetown and Johns Hopkins universities. "There are lots of good reasons to do this kind of thing, but the questions it raises all have to do with the nanny state: Should the government be collecting this kind of information? Should it be intervening like this?" Gostin said. "You can imagine it getting to the point where you have a public health worker showing up at your door and asking, 'Did you remember to exercise, eat right and take your medication today?' " The government has a long history of tracking infectious diseases -- including cholera, gonorrhea, malaria, plague and, more recently, AIDS -- to protect the public. In addition to requiring that such diseases be reported, public health officials have sometimes taken more aggressive steps, quarantining sick travelers, confining tuberculosis patients who are not taking their drugs and notifying the sexual partners of people with syphilis. Governments also track cancer cases to spot clusters. Some managed health care plans have begun gathering information about chronic diseases and notifying doctors and patients when care could be improved. But the New York effort marks the first time any government has required routine reporting of laboratory test results for a major chronic, noninfectious disease so that government officials can scrutinize how well doctors and patients are treating it. "It's really a natural consequence of calling everyday health conditions epidemics and public health threats," said Wendy K. Mariner of Boston University's schools of public health and law. "We've begun to talk about chronic diseases in the same way we talk about contagious diseases, and so it follows that we would start to take the same kind of public health measures." Under the plan, beginning on Sunday all 120 New York medical testing laboratories with the ability to transmit data electronically will be required to report the results of a blood test known as A1c within 24 hours. Diabetics undergo the test at least once a year to provide a long-term measurement of how well they are controlling their condition, in addition to the blood testing they do several times a day. Health officials first plan to use the data to monitor the quality of care and to determine which parts of the city are being hit hardest by diabetes. But health officials also plan to use the data to directly intervene in individual patients' care. In a program that will be tested first in the South Bronx, city officials will alert doctors about patients whose blood sugar levels are not being well controlled and will offer advice. Patients will be contacted. High blood sugar can lead to a host of devastating health problems, including heart attacks, kidney failure, amputations from nerve damage and blindness, but the effects can be limited by the careful use of diet, exercise, drugs and insulin. "It really ravages and wreaks havoc on the body," said Diana K. Berger, who heads the Diabetes Prevention and Control Program in the New York City Department of Health and Mental Hygiene. "People can live long, beautiful lives with diabetes, but if they don't take it seriously, it can be devastating." The plan has alarmed privacy advocates, particularly because the information is being collected without first getting patients' consent. "It's an incredible invasion to privacy to have your sensitive medical information grabbed by the city of New York," said Robin Kaigh, a New York lawyer who opposes the effort. "It shocks the conscience that they are not even required to tell you this is happening." Doctors may not even know data on their patients are being collected. "It's a little creepy that it's being done so undercover -- in the laboratories -- where it's completely out of sight of the doctor-patient interaction," said Twila J. Brase of the Citizens' Council on Health Care, a nonprofit group in Minnesota. Beyond the city having the information, other privacy advocates are concerned about whether the data could be passed on. "This is really a recipe for invasion of privacy," said Sue A. Blevins, president of the Institute for Health Freedom, a Washington-based advocacy group. "Under the law, personal health information can be shared without consent for many purposes. All it takes is a click of a mouse." That fear is shared by some diabetics. "I don't want the city knowing any more about my private life. I fear this information could be taken out of the data bank and disseminated to people or places I don't necessarily want it to be disseminated," said Steven Lazarus, 44, a diabetic who lives in Manhattan. Lazarus is also uncomfortable with the government getting involved in his medical care. "I don't want the city telling me what to do nor do I want the city telling my physician what to do," Lazarus said. Although diabetes does not carry the stigma that AIDS once did, information about a person having the disease could make it harder for someone to get health insurance or, perhaps, to get a job. "Government concern often shifts to government coercion," Mariner said. "Today we're telling people what you should do voluntarily. Tomorrow it may be we're telling you what to do or you'll be penalized." Because New York is often a leader in public health measures, the decision is likely to prompt other jurisdictions to follow, for diabetes and perhaps other conditions, Mariner and others said. City officials say the data will be kept strictly confidential. "The department of health has a 100-year history of collecting and protecting highly sensitive data," Berger said. "The privacy issues being raised pale in comparison to the public health benefit. How could we not do something about this ravaging epidemic?" Officials at the American Diabetes Association said the plan has merit as long confidentiality is protected. "We greatly support the idea of helping people with diabetes better manage their disease," said Richard Kahn, the association's chief scientific and medical officer. "We also are concerned with information about a person's individual medical condition becoming publicly known." Other experts praised the plan. "There are hundreds of thousands of Americans who are going to have heart attacks, strokes, amputations and dialysis because we are not paying good enough attention to their diabetes," said Benjamin Littenberg of the University of Vermont, who has been studying the approach. "This has got tremendous potential to prevent an enormous amount of misery, pain and premature death." primum non nocere Steve Schecter, NREMT-B This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient of this message, dissemination of this communication is prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify the sender immediately. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com To unsubscribe, send the command "SIGNOFF EMED-L" to LISTSERV(a)ITSSRV1.UCSF.EDU ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [Fwd: High-traffic Colluding Tor Routers in Washington, D.C. Confirmed]
by Roger Dingledine 06 Jul '18

06 Jul '18

On Fri, Apr 13, 2007 at 12:50:00PM -0400, Roger Dingledine wrote: > > A group of 9 Tor routers also functioning overtly or indirectly as Tor > > exit nodes have been observed colluding on the public Tor network. > > Yeah. This happened in mid 2006. I don't know why some random person > just picked it up now. "Nostra2004(a)Safe-mail.net" sent me some follow-up questions, which I'll answer here so we can keep the thread in one place. Maybe this will finally put the topic to rest. :) | How did Steven Murdoch and Richard Clayton tracked down the operator? I believe they made some phone calls to their friends who work in the network operations center at psinet. | How did they determine it was an innocent mistake? They know the person who was running them. It was somebody in the security field who was helping out but was embarrassed to realize that he was actually putting the network at risk by helping out quite so much. :) The fellow felt that private embarrassment was adequate, and asked not to be publically named. I trust them, and they trust him, so from my perspective it is now fine. | Even if the | operator is benevolent, that capability with so few nodes is disturbing. Yep. I agree. The Tor network may seem large, but it still needs to grow a lot larger to resist even medium sized attackers. | How were 9 nodes apparently able to touch 11% of all Tor traffic? If you launch a bunch of Tor servers that together push upwards of 200MBit/s each way sustained, ...that's a lot of bytes. Tor weights path selection by bandwidth -- otherwise Tor performance would be extremely miserable rather than just miserable. (http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#WhySlow) There are even several research projects currently looking at how to trade off a bit more privacy for better performance, including one of our GSoC interns. See also item #4 on http://tor.eff.org/volunteer#Research | Have changes to the code since then reduced this vulnerability? Yes. See the previous post: This issue also prompted us to speed up the fix/feature in 0.1.2.1-alpha: "Automatically avoid picking more than one node from the same /16 network when constructing a circuit." http://archives.seul.org/or/talk/Aug-2006/msg00300.html But the issue still exists with respect to people who control different /16 networks, and who can push lots of bytes (or trick us into thinking they can). | Do you think there needs to be activity (perhaps "collusion" between a | group of good guys), similar to what's on Bit Torrent, to identify and | blacklist nodes (discussions about the risks and legality of such | things can be left till later)? Well, the Tor directory authorities list servers, and can mark each server as invalid, badexit, etc. So in effect the authority operators can collude to blacklist nodes that we agree are behaving badly. A majority of authority operators need to claim something before clients will believe it. See http://tor.eff.org/svn/trunk/doc/spec/dir-spec.txt for a few more details. | Is there a transcript of the talk those slides were given with, or at | least a video? Yes, there is actually a video, courtesy the 23C3 folks: http://events.ccc.de/congress/2006/Streams look for talk 1513. For example, http://media.hojann.net/23C3/23C3-1513-en-detecting_temperature_through_clo… Hope that helps, --Roger ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[CCM-L] New tactical care teams aim to save more lives
by Eric Hodgson 06 Jul '18

06 Jul '18

Military expects TCCET teams to reduce combat mortality U.S. military planners hope to improve upon casualty survival rates by strengthening the capabilities of tactical critical care evacuation teams. TCCETs are trained and equipped to manage the most common causes for battlefield deaths such as uncontrolled bleeding, restricted airway and tension pneumothorax. <http://www.airforcetimes.com/news/2012/06/air-force-tactical- critical-evaluation-teams-060212w/> OR http://tinyurl.com/828vps8 _______________________________________________ CCM-L mailing list CCM-L(a)list.pitt.edu https://list.pitt.edu/mailman/listinfo/ccm-l ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Roger's status report, July 2012
by Roger Dingledine 06 Jul '18

06 Jul '18

Here's what I said at the beginning of July that I hoped to do: > - Attend the Dev meeting and hack fest in Florence. Help everybody > understand about our upcoming grants, and the upcoming deliverables that > go with them. Done. It was a great dev meeting and hack fest -- we had something like 40 Tor developers in one place. How the community has grown! https://trac.torproject.org/projects/tor/wiki/org/meetings/2012SummerDevMee… Thanks again to Gunner for helping us making sure everything went smoothly and we kept moving forward: http://aspirationtech.org/about/people/gunner > - Attend PETS Done: http://petsymposium.org/2012/program.php David Fifield gave a fantastic talk on our Flash Proxy design: http://crypto.stanford.edu/flashproxy/ I talked to Greg Norcie a lot about Tor Browser usability issues, progress we've made so far, and what remains to be done: http://petsymposium.org/2012/papers/hotpets12-1-usability.pdf If we had enough money we should totally be funding research grants for people like Greg to do further usability analysis. On the other hand, we have a pile of known problems and not enough developers to actually fix them -- so accruing *more* known problems, while great, maybe shouldn't be the most immediate goal. I should also draw your attention to Yossi Gilad's paper, "Spying in the Dark: TCP and Tor Traffic Analysis": http://freehaven.net/anonbib/papers/pets2012/paper_57.pdf It's another in the line of congestion-based traffic analysis papers (watch Alice's connection into the Tor network, send some packets to the suspected exit relay and/or destination website to reduce its TCP window, and then see if the flow on Alice's side slows down). It's unclear how bad it is in practice (i.e. how practical the attack is), but it's a nice example of how congestion attacks are not yet fully understood. The next PETS will be at Indiana University next summer. >plus do a talk at the 'provably privacy' workshop in Vigo. Done: https://www.cosic.esat.kuleuven.be/ecrypt/provpriv2012/program.html The ecrypt workshop was a tough combination of people who already did Tor research and people who didn't know that Tor doesn't mix. It ended up being in part a group discussion of Tor's toughest research attacks, to try to raise awareness of issues rather than suggest solutions. > - Probably go to Berkeley for the last week in July. Done. I met with EFF people for a day (mainly Peter Eckersley, talking with Mike Perry and Isis about how to salvage our browser situation in the face of both Firefox and Chrome including new privacy-invasive features at a faster clip than we can keep up with). I had lunch with Prateek Mittal, a post-doc at Berkeley who used to be in Nikita Borisov's lab at Illinois. Prateek is working on Sybil resistance and social-network-based security -- e.g. routing through your social network to resist some of the attacks that Tor has problems with. I also met briefly with Doug Tygar, a Berkeley prof who is working on evaluating circumvention tools, and with Vern Paxson's group at ICSI, who are looking into how to reason about pluggable transports and find ways to do better at the arms race. > - Summarize open simulation tickets and open performance tickets, so we > can prioritize them and get more developer attention on them. I talked to Karsten and Rob about performance work at the dev meeting, and we moved each ticket forward individually. I haven't had a chance to sit down and organize them en masse though: https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/Performance Nickm now has a list of specific Tor development tasks (mostly of the form "clean up this patch so it's something we'd be willing to merge"). And Rob has been doing simulations on our current patches to help us decide which ones should actually help: https://trac.torproject.org/projects/tor/ticket/6401 > - Publicize one or more new job openings on our jobs page: > https://www.torproject.org/about/jobs.html.en > and start collecting applications. I helped Mike get the Tor Browser Hacker job description up and announced: https://www.torproject.org/about/jobs-browserhacker Now we need to get enough applications and interest that we have great people to select from. > - Make sure our new core dev gets added to the people page, and make > sure we do some sort of announcement so there's closure. Follow-up on > the original core dev job announcements to say we've got one (but leave > the job announcement up, because we wouldn't mind having another if the > perfect person came along). I just added Andrea to the core people page, along with some other people who have been core people for a while but never made it onto the page. We continue to have a blurry line between which of our fine volunteers happens to make it into the core people page. I think we should probably put more of them on it -- isis and Moritz come to mind, as well as David Fifield, Philipp Winter, the Tails people, Ian Goldberg, and others. All that said, I don't think we've actually done any sort of announcement or acknowledgement about the core dev spot. Should we? > - Ian told me that Tariq's "Changing of the Guards" paper was flawed. I > don't yet agree that it's flawed -- I should follow up with them and see > which parts of the design need to be discarded and which I can resurrect. Tariq, Ian, I, and others ended up adapting the paper into a WPES submission, which focuses on Tariq's framework for how to answer questions about bridge churn. I still think the investigation has uncovered a really interesting privacy vulnerability: if the Tor client has perfect connectivity, it will pick three guards, and if one of them goes offline it will continue in a degraded "two guard" state rather than picking a fourth guard and risking showing its circuits to a new relay. So far so good. But a client with bad connectivity will end up with dozens or even hundreds of guards on its list, and when one of its top three goes away it will move to a fourth. Somewhere in there it would seem this is suboptimal behavior. More research required, as they say. > - Get Tor 0.2.3.x closer to stable. We released 0.2.3.19-rc on 2012-07-06. > - Organize and announce (hopefully in that order) our upcoming plans > for encouraging more exit relays. Done: https://lists.torproject.org/pipermail/tor-relays/2012-July/001433.html I spent much of my second half of July on this topic, including individual mail threads with many of the fast exit and non-exit relay operators, to strengthen the community and learn who is in a good position for growing their relay. We have several trac tickets following the "diversity metrics" side: https://trac.torproject.org/projects/tor/ticket/6232 https://trac.torproject.org/projects/tor/ticket/6443 https://trac.torproject.org/projects/tor/ticket/6498 https://metrics.torproject.org/fast-exits.html I also talked to Sathya about having him do his undergrad thesis on the question of measuring and tracking diversity in the Tor network. It would be great to see more Tor research groups take an interest and give him some guidance. Next steps for me on the exit relay front are to hit up my contacts at universities (Boston University and University of Waterloo run fast exits, but many more want to if I just help them enough); figure out how logistically we can get money to the exit relay operators who need it; and figure out how to integrate Moritz into the "continuing to strengthen the relay operator community" role. > - Track down all the plans for my November trip to Amsterdam. The original > plan was to speak in Rotterdam at their CA conference (organized after > the DigiNotar thing), but that expanded to maybe talking to Dutch law > enforcement, and then maybe Austrian law enforcement, and now the Belgian > law enforcement want me to come explain the Internet to them too. All of > these things are worth doing (the more law enforcement groups understand > Tor, the less they hassle our exit relay operators and the less they > lobby for laws to outlaw privacy), but we'll see how many I can fit in. Not started. Should do rsn. > - Start looking into properties we want for a more DPI-resistant "obfs3" > protocol. I talked to Ian Goldberg about it, and got him talking to George (asn) at PETS. I believe they have a plan, and I think Brandon Wiley (our gsoc student) is even planning to integrate it into his python pluggable transport library. Stay tuned for more details. ------------------------------------------------------------------------ Here are some other things I did in July: - While in Vigo, I called in to the SponsorF site visit to help brief the program manager on our progress. One of the followups is that we should either get a 320KB torperf instance running (since 50KB is very small), or better, get something running that fetches some actual popular web pages including their css, images, etc. We could either do it as "this is how long it takes in practice to load the frontpage of foo.com", which would show us realistic performance over time, or we could set up a fake foo.com so real-world website changes don't add another variable. - Had multiple tor-exec budget meetings to figure out how to do all the new things our sponsors want, without running out of money. We have a plan, and it looks good. I look forward to learning how much that means we can scale up in 2013. - Helped Karsten plan for the SponsorL deliverables: https://lists.torproject.org/pipermail/tor-dev/2012-July/003808.html - Did a bit of actual Tor development, including tracking down some fun bugs like https://trac.torproject.org/projects/tor/ticket/6404 ------------------------------------------------------------------------ Here are some items I expect to do in August: - Chair the FOCI workshop at Usenix Security, and also attend the rest of Usenix Security. https://www.usenix.org/conference/foci12/tech-schedule/workshop-program https://www.usenix.org/conference/usenixsecurity12/tech-schedule/technical-… - Talk to Ralf-Philipp Weinmann about his TorScan paper (upcoming at Esorics) and what we can do to address his attacks. - Look at Rob Jansen's performance graphs from his new Shadow simulations. Try to move the performance tickets forward. - Expand on the set of metrics by which the SponsorF Red Team will judge the project's success. Specifically, I should list the anonymity attacks that they shouldn't evaluate since the PETS community is already doing a good job at evaluating anonymity attacks. - Launch the "run fast bridges for BBG" campaign, ideally by gathering volunteers on tor-relays. - Launch the "exit relays at universities" push, and send BBG a timetable for how our exit relay rollout is looking. - Get some money to some exit relay operators, since it turns out (ha) that it's harder than I expected on our side to do it in a way we'll pass our audits. - Get 0.2.3.20-alpha and 0.2.3.21-alpha out. - Consider an 0.2.2.38 stable update. - Consider an 0.2.4.1-alpha release. - Sort out my September travel to Germany, and my November travel to Netherlands et al. - Schedule our NSF "censorship measurement" kickoff meeting, perhaps the last week of September or first of October. - Encourage Andrew to put our "project coordinator" job description up and announce it. - Try to take a vacation Aug 11-19. ------------------------------------------------------------------------ Things I'm still dropping the ball on: - Transparently document the secteam process, especially since we have concluded to use it far less often and only for critical security things. - Answer the thread between Karsten and Jake where we had an excited volunteer with a clearly useful contribution that we totally dropped on the floor. Try to generalize the experience to improve our response to new contributors. We used to be great at it, and lately we're all overloaded. - Add a "scientific papers" exception to our trademark-faq: I want to give blanket permission to scientific papers to use the word Tor in their paper name, so long as they don't go and write software under that name too. https://www.torproject.org/docs/trademark-faq - Make a plan for fixing all the "CBT sometimes breaks Tor" issues. https://trac.torproject.org/projects/tor/ticket/3443 - Start summarizing Tor research papers on the blog more regularly. There have been a huge number of really important research papers lately, and most Tor people don't know about them. Should I summarize them on the blog (for a broader audience), or on tor-dev (for the rest of the Tor developers), or what? - I need new business cards. - Get https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorA through D back up on the wiki somewhere (Andrew took them down since they were concluded, and since they just listed contract deliverables rather than the progress reports and trac ticket links that we've been doing for later funders; but we should keep them there for posterity). - Tell Micah Sherr and Chris Wacek (Georgetown) about the open simulation questions; and get Rob Jansen (UMN/NRL), Mashael AlSabah (Waterloo), etc a good summary of the current performance situation. _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Remove
by Cypherpunks 06 Jul '18

06 Jul '18

--E1B38D144E.968828456/ns1.venon.com--

1 0