July 2018 - cypherpunks-legacy

[cryptography] Diginotar Lessons Learned (long)
by Lucky Green 06 Jul '18

06 Jul '18

I can't help but chuckle about Diginotar's very public display of security incompetence. I mean, who in our line of work can be expected to keep a straight face when reading gems such as this one taken from the report by Diginotar's incidence response rapporteur: "The separation of critical components was not functioning or was not in place. We have strong indications that the CA-servers, although physically very securely placed in a tempest proof environment, were accessible over the network from the management LAN. The network has been severely breached. All CA servers were members of one Windows domain, which made it possible to access them all using one obtained user/password combination". http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2… We are also seeing a near universal call for "fixes" of the broken PKI paradigm. I couldn't agree more that fixes - and indeed redesigns - are badly needed and have been for some 15+ years. Pretty much since the day the word PKI was coined. What I hear much more rarely are discussions if the proposed fixes actually solve the problem. What I hear hardly ever are discussions as to which unintended consequences the proposed (and in some cases already implemented fixes) may bring. When designing an improvement to a system, it helps to keep in mind the original requirements the system was intended to address. In the case of SSL server certs, those requirements roughly were: - provide Joe Browser user with the ability to connect to a site with which Joe has no prior relationship while giving Joe sufficient confidence that the site is who they say they are without MITM for Joe to part with his credit card number. The public CA infrastructure, high-profile failures notwithstanding, has done a reasonable job meeting that requirement. - shift liability for this authentication from the browser vendors to a third-party (CA). The current system has done a flawless job at this. Defenses such as HSTS and cert pinning cannot do better and likely will do worse, since the browser vendors are getting more actively involved in the decision which sites to protect with the "best" level of security. Indeed, security designers and auditors for financial services firms that fail to demand inclusion of their site in HSTS and cert pinning lists are arguably falling behind on best practices. It is not inconceivable that we will see litigation against a browser vendor initiated by a website that was compromised by a bad cert after the browser vendor refused to include the website in their HSTS lists. Note that there is no chance that browser vendors will be willing to create the infrastructure and build up staffing levels such that all legitimated websites are protected by in-browser HSFS lists. Yet the more sites a browser vendor adds to their HSTS or cert pinning lists, the higher the risk of litigation becomes. - avoid the server vendor (at the time those requirements were identified the sever vendor was equal to the browser vendor) from incurring the costs of having to verify the authenticity of each website or domain. The labor cost of adding cert pinning for a domain from a browser vendor's perspective is identical to that of adding to the browser the hash of a CA operated by that domain. Which is identical to the cost a browser vendor would incur authenticating each website. Not going to happen. At scale, any such list cannot be handled via code updates, but has to be dynamically provided as a service by the browser vendor. Meaning the browser vendor becomes isomorphic to a root CA from the perspective of the users of that browser. - limit the cost of security to the server operator. Website and other encrypted service operators are annoyed as it is obtaining certificates from one CA. It is unreasonable to ask a website operator to engage in separate dealings with each browser vendor. Instead, both the website operator and the browser vendors will prefer dealing with a single entity (or small number) of trusted third parties (TTP). Such as a public CA. - no single trusted entity. Whether you design a security protocol or software counting widgets, there really is only one of three numbers that your design needs to be able to accommodate: one, a few, or a great many. In the public server authentication space, "one" translates to a global authority issuing credentials. It is not clear who that authority would be. Presumably the United Nations. What is clear is that national interests preclude the use of a single global authentication authority. It is conceivable for each country to have a local authentication authority, which would require each country to operate some authentication authority. There is no agreement how many countries exist on our planet, but the number is somewhere around 200. More than there are root CAs in the browsers today. Which gets us to the next number: "a few". A few represents the status quo. Under the status quo, a few CAs are issuing certs. Some CAs have a better security track record than others, though most CAs with an unblemished security record have simply not yet been attacked, failed to disclose attacks, or don't issue certs to customers on the Internet at large and therefore can afford to operate in a purely offline environment. The latter option is not available to CAs or other services that authenticate a large number of domains. When operated by national governments rather than global vendors, one can envision designs in which national CAs issue certificates only for entities located within the nation's borders. Such designs quickly lead to a requirement for a global database (see "one" above) or to a scenario in which Iran's national authority can issue certificates for gmail.com. Moreover, such a design carries the high risk of leading to a need for each site to obtain separate certs for each country in which it operates. That outcome would be welcomed by certain governments, be perhaps organizationally manageable for a large server operator such as Google, but be intractable for many other sites. In addition to likely being detrimental to both the exchange of ideas and security of the Internet as a whole. The "a great many" scenario translates to designs in which each browser reports the certs seen up to a central database, alerting the user if the cert presented by a server doesn't match (most) of those certs that were seen by users of the same service. Meaning the browser vendors or some global entity have to operate a server that more or less logs each https access. I am not sure how I feel about that. What I do know is that it creates a whole new attack surface for other types of attacks. I also believe that for example Tor users, a known target for fake SSL server certs, would unlikely consider such a design to be an improvement. Other designs in the "a great many" category log SSL server certs only locally, alerting the user when a certificate for a particular site previously visited has changed. I can see value in that features. But we need to realize that this feature will add to the SSL server cert alert fatigue users are already experiencing. Time and large field trials will tell if such a feature is a security net positive. It may increase the security posture of very security conscious Tor users. It will not solve the problem for the average Gmail user. Not even for the average Gmail user in Iran. - generate recurring revenue Often mentioned as the primary reason for the existence of CAs, generating recurring revenue is a driver for significant percentage of those in the CA business, but as we have seen above the overall number of entities that derive revenue from issuing certs is quite small. It is, well, "a few". The perceived benefits to the issuer are a powerful driver in the client cert space, where the desire for attribution makes the sum total of drivers in the SSL server cert space tiny by comparison. But we are not talking about client certs here. Most CAs do not make a significant amount money from issuing server certs and the handful of CAs that do likely would do just as well operating alternative authentication systems, be that on behalf of a national SSL server cert authority or on behalf of a browser vendor needing to maintain an HSTS list. The cost structure is dominated by validation costs at any rate and that holds true whether the end result is a signed cert or an entry in a browser's HSTS or cert pinning list. There are additional requirements that drive the existance of SSL server certs and public CAs. The requirements I outlined in this post will suffice to illustrate my point: unless some proposed SSL/CA replacement/augmentation system will do at least as well at meeting those requirements as the status quo, the design is unlikely to succeed in the marketplace. As you are being bombarded with design proposals promising improvement over the status quo in the next weeks and months - and are prehaps are working on designs of your own - it will be helpful to validate those designs against the requirements prior to chosing to implement the design. --Lucky Green _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] TOR-based darknet - negative publicity
by liberationtech＠lewman.us 06 Jul '18

06 Jul '18

On Thu, Oct 20, 2011 at 08:34:29PM -0400, ed.webb(a)gmail.com wrote 0.8K bytes in 18 lines about: : This report on Anonymous' takedown of servers hosting child : pornography is the kind of publicity TOR doesn't want, presumably: : http://diigo.com/0kinp I wonder how that action is different than this, https://lists.torproject.org/pipermail/tor-talk/2011-September/021198.html And you can always tell when someone doesn't bother to talk to Tor itself, https://www.torproject.org/docs/faq.html.en#WhyCalledTor Also, https://www.torproject.org/docs/faq-abuse.html.en#RemoveContent -- Andrew pgp key: 0x74ED336B _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[i2p] weekly status notes [nov 30]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all * Index 1) 0.4.2 and 0.4.2.1 2) mail.i2p 3) i2p-bt 4) eepsites 5) ??? * 1) 0.4.2 and 0.4.2.1 Since we finally pushed out 0.4.2, the network's reliability and throughput shot up for a while, until we ran into the brand new bugs we created. IRC connections for most people are lasting for hours on end, though for some who have run into some of the problems, its been a bumpy ride. There have been a slew of fixes [1] though, and later on tonight or early tomorrow we'll have a new 0.4.2.1 release ready for download. [1] http://dev.i2p.net/cgi-bin/cvsweb.cgi/i2p/history.txt?rev=HEAD * 2) mail.i2p Earlier today I got slipped a note from postman saying he had some things he wanted to discuss - for more info, see the meeting logs (or if you're reading this before the meeting, swing on by). * 3) i2p-bt One of the downsides of the new release is that we're running into some trouble with the i2p-bt port. Some of the problems have been identified found and fixed in the streaming lib, but further work is necessary to get it where we need it to be. * 4) eepsites There has been some discussion over the months on the list, in the channel, and on the forum about some problems with how eepsites and the eepproxy work - recently some have mentioned problems with how and what headers are filtered, others have brought up the dangers of poorly configured browsers, and there's also DrWoo's page [2] summarizing many of the risks. One particularly note worthy event is the fact that some people are actively working on applets that will hijack the user's computer if they do not disable applets. (SO DISABLE JAVA AND JAVASCRIPT IN YOUR BROWSER) This, of course, leads to a discussion of how we can secure things. I've heard suggestions of building our own browser or bundling one with preconfigured secure settings, but lets be realistic - thats a lot more work than anyone here is going to bite into. However, there are three other camps: 1) Use a fascist HTML filter and tie it in with the proxy 2) Use a fascist HTML filter as part of a script that fetches pages for you 3) Use a secure macro language The first is pretty much like we have now, except we filter the content rendered through something like muffin or freenet's anonymity filter. The downside here is that it still exposes HTTP headers so we'd have to anonymize the HTTP side as well. The second is much like you can see on http://duck.i2p/ with the CGIproxy, or alternately as you can see in freenet's fproxy. This takes care of the HTTP side as well. The third has its benefits and drawbacks - it lets us use much more compelling interfaces (as we can safely use some known safe javascript, etc), but has the downside of backwards incompatability. Perhaps a merge of this with a filter, allowing you to embed the macros in filtered html? Anyway, this is an important development effort and addresses one of the most compelling uses of I2P - safe and anonymous interactive websites. Perhaps someone has some other ideas or info as to how we could get what is needed? [2] http://brittanyworld.i2p/browsing/ * 5) ??? Ok, I'm running late for the meeting, so I suppose I should sign this and send it on its way, 'eh? =jr [lets see if I get gpg to work right...] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBrOBZGnFL2th344YRArtBAJ9YhRvP3MczO96gi4Xwnowie55HlACgzlO3 1uyX1xgZLboelTOSdermS+Q= =e5Xv -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[Freedombox-discuss] alternative hardware idea
by John Sturdy 06 Jul '18

06 Jul '18

I heard Eben's talk at FOSDEM, and it occurred to me that, in some jurisdictions, ownership of a Freedom Box could itself be regarded as either suspicious or even criminal. (For example, countries that restrict cryptography, or can jail you for not disclosing keys, as is the case in the UK.) So it would make sense to run the software on a device that has some other reason to justify its existence / presence; perhaps some kind of embedded device that is always switched on. A specific such device, that at first I thought of just because of the irony of it, is the wireless IP CCTV camera. On further thought, it seems this could be specifically a very suitable kind of device for the purpose, as it has a continuous stream of information-poor data which would be ideal for encoding things in steganographically. As an added benefit, such cameras could also form a sousveillance network. (Quick introduction: I'm a programmer, based in the UK. I don't think my skillset has much overlap with what's needed for this project, but I just wanted to drop this idea in, in case it's useful.) _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[Freedombox-discuss] alternative hardware idea
by John Sturdy 06 Jul '18

06 Jul '18

I heard Eben's talk at FOSDEM, and it occurred to me that, in some jurisdictions, ownership of a Freedom Box could itself be regarded as either suspicious or even criminal. (For example, countries that restrict cryptography, or can jail you for not disclosing keys, as is the case in the UK.) So it would make sense to run the software on a device that has some other reason to justify its existence / presence; perhaps some kind of embedded device that is always switched on. A specific such device, that at first I thought of just because of the irony of it, is the wireless IP CCTV camera. On further thought, it seems this could be specifically a very suitable kind of device for the purpose, as it has a continuous stream of information-poor data which would be ideal for encoding things in steganographically. As an added benefit, such cameras could also form a sousveillance network. (Quick introduction: I'm a programmer, based in the UK. I don't think my skillset has much overlap with what's needed for this project, but I just wanted to drop this idea in, in case it's useful.) _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[i2p] weekly status notes [nov 30]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all * Index 1) 0.4.2 and 0.4.2.1 2) mail.i2p 3) i2p-bt 4) eepsites 5) ??? * 1) 0.4.2 and 0.4.2.1 Since we finally pushed out 0.4.2, the network's reliability and throughput shot up for a while, until we ran into the brand new bugs we created. IRC connections for most people are lasting for hours on end, though for some who have run into some of the problems, its been a bumpy ride. There have been a slew of fixes [1] though, and later on tonight or early tomorrow we'll have a new 0.4.2.1 release ready for download. [1] http://dev.i2p.net/cgi-bin/cvsweb.cgi/i2p/history.txt?rev=HEAD * 2) mail.i2p Earlier today I got slipped a note from postman saying he had some things he wanted to discuss - for more info, see the meeting logs (or if you're reading this before the meeting, swing on by). * 3) i2p-bt One of the downsides of the new release is that we're running into some trouble with the i2p-bt port. Some of the problems have been identified found and fixed in the streaming lib, but further work is necessary to get it where we need it to be. * 4) eepsites There has been some discussion over the months on the list, in the channel, and on the forum about some problems with how eepsites and the eepproxy work - recently some have mentioned problems with how and what headers are filtered, others have brought up the dangers of poorly configured browsers, and there's also DrWoo's page [2] summarizing many of the risks. One particularly note worthy event is the fact that some people are actively working on applets that will hijack the user's computer if they do not disable applets. (SO DISABLE JAVA AND JAVASCRIPT IN YOUR BROWSER) This, of course, leads to a discussion of how we can secure things. I've heard suggestions of building our own browser or bundling one with preconfigured secure settings, but lets be realistic - thats a lot more work than anyone here is going to bite into. However, there are three other camps: 1) Use a fascist HTML filter and tie it in with the proxy 2) Use a fascist HTML filter as part of a script that fetches pages for you 3) Use a secure macro language The first is pretty much like we have now, except we filter the content rendered through something like muffin or freenet's anonymity filter. The downside here is that it still exposes HTTP headers so we'd have to anonymize the HTTP side as well. The second is much like you can see on http://duck.i2p/ with the CGIproxy, or alternately as you can see in freenet's fproxy. This takes care of the HTTP side as well. The third has its benefits and drawbacks - it lets us use much more compelling interfaces (as we can safely use some known safe javascript, etc), but has the downside of backwards incompatability. Perhaps a merge of this with a filter, allowing you to embed the macros in filtered html? Anyway, this is an important development effort and addresses one of the most compelling uses of I2P - safe and anonymous interactive websites. Perhaps someone has some other ideas or info as to how we could get what is needed? [2] http://brittanyworld.i2p/browsing/ * 5) ??? Ok, I'm running late for the meeting, so I suppose I should sign this and send it on its way, 'eh? =jr [lets see if I get gpg to work right...] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBrOBZGnFL2th344YRArtBAJ9YhRvP3MczO96gi4Xwnowie55HlACgzlO3 1uyX1xgZLboelTOSdermS+Q= =e5Xv -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[osint] Your License, Your Urine
by Tefft, Bruce 06 Jul '18

06 Jul '18

http://www.alternet.org/story/19008/ Posted on June 21, 2004 Your License, Your Urine By Paul Armentano Imagine if it were against the law to drive home after consuming a single glass of wine at dinner. Now imagine it is illegal to drive after having consumed a single glass of wine two weeks ago. Guess what? If you smoke pot, it's time to stop imagining. Legislation weaving its way through the US Congress demands all 50 states pass laws granting police the power to drug test drivers and arrest anyone found to have "any detectable amount of a controlled substance ... present in the person's body, as measured in the person's blood, urine, saliva, or other bodily substance." Though the expressed purpose of the law is to target and remove drug-impaired drivers from US roadways, the proposal would do nothing of the sort. Most troubling, the proposed law -- H.R. 3922 -- does not require motorists to be identifiably impaired or intoxicated in order to be criminally charged with the crime of "drugged driving." Rather, police have only to demonstrate that the driver has detectable levels of illicit drugs or inactive drug metabolites in their blood, sweat, saliva or urine. As many pot smokers know, marijuana metabolites are fat soluble, and remain identifiable in the urine for days and sometimes even weeks after past use. Consequently someone who smoked a joint on Monday could conceivably be arrested on Friday and charged with "drugged driving," even though they are perfectly sober! Here's how the law would work. Police, at their discretion, could order motorists during a traffic stop to undergo a drug test, most likely a urine test. If the driver's urine tests positive for prior pot use then he or she would automatically be charged and eventually found guilty of the criminal offense of driving under the influence of drugs -- even if the pot in question was consumed weeks earlier. Under the law, the fact that the driver is not impaired is irrelevant; the only "evidence" necessary is the positive test result. So Who's Behind This? Over the past five years, a small cabal of prohibitionists, drug testing proponents and toxicologists have pushed for legislation criminalizing drivers who operate a vehicle with inert drug metabolites present in their system. To date, their efforts have persuaded ten states -- Arizona, Georgia, Iowa, Illinois, Indiana, Minnesota, Pennsylvania, Rhode Island, Utah and Wisconsin -- to pass such "drugged driving" laws, known as zero-tolerance per se laws. Leading this charge is the Walsh Group, a federally funded organization that develops drug testing technology and lobbies for rigid workplace drug testing programs. Walsh Group President, Michael Walsh, is the former Director of the Division of Applied Research at the US National Institute on Drug Abuse (NIDA) and formerly served as the Associate Director of the Office of National Drug Control Policy (ONDCP), informally known as the Drug Czar's office In November 2002, the group partnered with the ONDCP to lobby state legislatures to amend their drugged driving laws. Every state has laws on the books prohibiting motorists from driving "under the influence" of a controlled substance. Like drunk driving laws, virtually all of these laws require the motorists to be impaired by their drug use in order to be charged with "drugged driving." Nevertheless, the Walsh Group argued that these existing laws are too lax on illicit drug users. To bolster their claim, they argued -- without explanation -- that actually linking illicit drug use to impaired driving is a "technically complicated and difficult task." Their solution? States should enact zero tolerance per se laws redefining "drugged drivers" as any motorist who tests positives for any level of illicit drugs or drug metabolites, regardless of whether their driving is impaired. "There is clearly a need for national leadership at the federal level to develop model statutes and to strongly encourage the states to modify their laws," the organization concluded in a widely disseminated report. Notably, the authors failed to mention that the widespread enactment of such a policy would be a political and financial windfall for the Walsh Group's drug testing technology and consulting services. The Walsh Group is hardly the only organization with something to gain from the Bush administration's proposed "drugged driving" crackdown. Speaking at a White House-sponsored symposium in February, former 1970s Drug Czar Robert Dupont -- another ex-NIDA director who now heads the workplace drug testing consultation firm Bensinger, Dupont & Associates (BDA) -- also demanded the federal government mandate zero-tolerance drugged driving laws. "Workplace drug testing has prepared us for drugged driving testing," Dupont told attendees, arguing that just as many public and private employees are subjected to random drug screening, so should be motorists. Those drivers who test positive, says Dupont, should then be monitored through regularly scheduled drug tests, including hair testing, for a period of two to five years. "The benefits of this approach will be improved highway safety," he concluded, failing to explain how punishing sober drivers while simultaneously lining BDA's pockets would make America's roadways any safer. Cruising on Cannabis: What's the Problem? "Driving under the influence of, or after having used, illegal drugs has become a significant problem worldwide," states the preamble to H.R. 3922. However, despite the government's claim, epidemiological evidence on the number of motorists who drive under the influence of illicit drugs is scarce. Further, among the limited evidence that does exist, much of it finds that pot's measurable yet relatively mild effects on psychomotor skills do not appear to play a significant role in vehicular crashes, particularly when compared to alcohol. "Crash culpability studies have failed to demonstrate that drivers with cannabinoids in the blood are significantly more likely than drug-free drivers to be culpable in road crashes," summarized researchers Gregory Chesher and Marie Longo in the recent book Cannabis and Cannabinoids: Pharmacology, Toxicology, and Therapeutic Potential. A 2002 Canadian Senate report was even more succinct, stating, "Cannabis alone, particularly in low doses, has little effect on the skills involved in automobile driving." Nonetheless, Congress' proposed bill specifically and disproportionately targets motorists who may occasionally smoke pot because marijuana's metabolites exit the body more slowly than other drug metabolites, often remaining detectable in urine for several weeks at a time. Equally troubling, there currently exists no technology that can accurately correlate drug metabolite concentration to impairment of performance. Of course, such concerns are no bother to those in Congress who intend to ride this latest wave of drug war rhetoric to reelection. Nor are they of much worry to those in the drug testing industry who stand to make a fortune prosecuting and jailing sober pot smokers. As for everybody else, be afraid; be very afraid. And be sure to keep a fresh sample of urine in the glove compartment. This article originally appeared in Heads Magazine in Canada. (c) 2004 Independent Media Institute. ------------------------ Yahoo! Groups Sponsor --------------------~--> Yahoo! Domains - Claim yours for only $14.70 http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Everyone and no one wants to save the world
by Kragen Javier Sitaker 06 Jul '18

06 Jul '18

I was reading the Reuters piece today on Julian Assange by Mark Hosenball, "Special Report: Julian Assange versus the world", which I would link to if Reuters provided stable URLs. He gives mixed reviews to Assange's published writings: > His blog entries, which can still be found on the web, are a mixture > of pseudo-scientific and philosophical gibberish, cultural and > literary observations ("Kurt Vonnegut is dead."), extremely technical > computer coding sequences and often jumbled political statements. Pseudo-scientific and philosophical gibberish? That hardly seems in character with the hard-nosed, unflappable public figure we see today. I wondered which writings Hosenball meant. He goes into more detail a bit later: > In an essay entitled "Jackboots," Assange describes how he felt that > his own personal travails were comparable to the experiences of Gulag > prisoners in Alexander Solzhenitsyn's novel "The First Circle" -- the > story of a brilliant mathematician imprisoned by Stalin and forced to > choose between aiding the state or being transferred to a Siberian > camp. > "To feel that home is the comraderie (sic) of persecuted, and infact > (sic) prosecuted, polymaths in a Stalinist slave labor camp! How close > the parallels to my own adventures!" Another essay, this one almost > incomprehensible, is headlined: "Everyone and no one wants to save the > world." Almost incomprehensible, eh? I googled up a copy at <http://www.sidkay.com/post/1985856429/everyone-and-no-one-wants-to-save-the…>. It turns out to be perfectly clear and lucid, although it contains a number of debatable and unsupported assertions. My conclusion: Hosenball merely cannot tell the difference between material beyond his own rather mediocre reading level, and gibberish. Here's the essay, with spelling and punctuation improved because the original hurts my eyes: > Everyone and no one wants to save the world > ------------------------------------------- > When the world extended to onebs surrounding hills and mountains and > over them was only legend, saving the world was approachable, and a > natural activity to all of independent character. > You do not need to justify the possession of these noble instincts. > Such attributes are normally distributed. You have a constellation of > these attributes and that makes you who you are. Recognise that the > substantial ones are invariant. > You must satisfy your invariant instincts or you will be at odds with > your own character. It is only when we are not at odds with our basic > makeup that we can find life meaningful. > To exercise your instinct for saving the world requires saving what > you perceive to be the world. > Being modern, educated and wordly, the world you perceive is immense > and this is disempowering compared to the valley world of your > ancestors, where your feelings were forged, and where saving 10 people > saved 10% of the b worldbbs population. > Here lies the difficulty in actualising your character. Your > perception is of a world so vast that that you can not envisage your > actions making a meaningful difference. > People try to fool themselves and others into believing that one can > b think globally and act locallyb; however, to anyone with a sense of > proportion b not most people, btw b thinking globally makes acting > locally seem to be a marginal activity. Itbs not setting the world to > rights. > To meaningfully interact with the world, you have to either constrain > your perception of what it is back to valley proportions by eschewing > all global information (most of us here have engaged on just the > opposite course, which is what has provoked this discussion), losing > your sense of perspective b or start seriously engaging with the modern > perception of the world. > That latter path can be hard to find, because it is only satisfied by > creating ideas or inventions that have a global impact. Perhaps I have > found one, and therebs others out there, but for most people of your > character, a combination of eschewing knowledge of those parts of the > world they canbt change, and robust engagement with the parts they > can, is probably optimal. > Do not be concerned about when one is to do good, who defines good, > etc. Act in the way you do because to do otherwise would to be at > odds would to be at odds with yourself. Being on a path true to your > character carries with it a state of flow, where the thoughts about > your next step come upon waking, unbidden, but welcome. > I support similarly minded people, not because they are moral agents, > but because they have common cause with my own feelings and dreams. > <http://web.archive.org/web/20071020051936/http://iq.org/#Everyoneandnoonewa…> -- To unsubscribe: http://lists.canonical.org/mailman/listinfo/kragen-tol ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Everyone and no one wants to save the world
by Kragen Javier Sitaker 06 Jul '18

06 Jul '18

I was reading the Reuters piece today on Julian Assange by Mark Hosenball, "Special Report: Julian Assange versus the world", which I would link to if Reuters provided stable URLs. He gives mixed reviews to Assange's published writings: > His blog entries, which can still be found on the web, are a mixture > of pseudo-scientific and philosophical gibberish, cultural and > literary observations ("Kurt Vonnegut is dead."), extremely technical > computer coding sequences and often jumbled political statements. Pseudo-scientific and philosophical gibberish? That hardly seems in character with the hard-nosed, unflappable public figure we see today. I wondered which writings Hosenball meant. He goes into more detail a bit later: > In an essay entitled "Jackboots," Assange describes how he felt that > his own personal travails were comparable to the experiences of Gulag > prisoners in Alexander Solzhenitsyn's novel "The First Circle" -- the > story of a brilliant mathematician imprisoned by Stalin and forced to > choose between aiding the state or being transferred to a Siberian > camp. > "To feel that home is the comraderie (sic) of persecuted, and infact > (sic) prosecuted, polymaths in a Stalinist slave labor camp! How close > the parallels to my own adventures!" Another essay, this one almost > incomprehensible, is headlined: "Everyone and no one wants to save the > world." Almost incomprehensible, eh? I googled up a copy at <http://www.sidkay.com/post/1985856429/everyone-and-no-one-wants-to-save-the…>. It turns out to be perfectly clear and lucid, although it contains a number of debatable and unsupported assertions. My conclusion: Hosenball merely cannot tell the difference between material beyond his own rather mediocre reading level, and gibberish. Here's the essay, with spelling and punctuation improved because the original hurts my eyes: > Everyone and no one wants to save the world > ------------------------------------------- > When the world extended to onebs surrounding hills and mountains and > over them was only legend, saving the world was approachable, and a > natural activity to all of independent character. > You do not need to justify the possession of these noble instincts. > Such attributes are normally distributed. You have a constellation of > these attributes and that makes you who you are. Recognise that the > substantial ones are invariant. > You must satisfy your invariant instincts or you will be at odds with > your own character. It is only when we are not at odds with our basic > makeup that we can find life meaningful. > To exercise your instinct for saving the world requires saving what > you perceive to be the world. > Being modern, educated and wordly, the world you perceive is immense > and this is disempowering compared to the valley world of your > ancestors, where your feelings were forged, and where saving 10 people > saved 10% of the b worldbbs population. > Here lies the difficulty in actualising your character. Your > perception is of a world so vast that that you can not envisage your > actions making a meaningful difference. > People try to fool themselves and others into believing that one can > b think globally and act locallyb; however, to anyone with a sense of > proportion b not most people, btw b thinking globally makes acting > locally seem to be a marginal activity. Itbs not setting the world to > rights. > To meaningfully interact with the world, you have to either constrain > your perception of what it is back to valley proportions by eschewing > all global information (most of us here have engaged on just the > opposite course, which is what has provoked this discussion), losing > your sense of perspective b or start seriously engaging with the modern > perception of the world. > That latter path can be hard to find, because it is only satisfied by > creating ideas or inventions that have a global impact. Perhaps I have > found one, and therebs others out there, but for most people of your > character, a combination of eschewing knowledge of those parts of the > world they canbt change, and robust engagement with the parts they > can, is probably optimal. > Do not be concerned about when one is to do good, who defines good, > etc. Act in the way you do because to do otherwise would to be at > odds would to be at odds with yourself. Being on a path true to your > character carries with it a state of flow, where the thoughts about > your next step come upon waking, unbidden, but welcome. > I support similarly minded people, not because they are moral agents, > but because they have common cause with my own feelings and dreams. > <http://web.archive.org/web/20071020051936/http://iq.org/#Everyoneandnoonewa…> -- To unsubscribe: http://lists.canonical.org/mailman/listinfo/kragen-tol ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[osint] Your License, Your Urine
by Tefft, Bruce 06 Jul '18

06 Jul '18

http://www.alternet.org/story/19008/ Posted on June 21, 2004 Your License, Your Urine By Paul Armentano Imagine if it were against the law to drive home after consuming a single glass of wine at dinner. Now imagine it is illegal to drive after having consumed a single glass of wine two weeks ago. Guess what? If you smoke pot, it's time to stop imagining. Legislation weaving its way through the US Congress demands all 50 states pass laws granting police the power to drug test drivers and arrest anyone found to have "any detectable amount of a controlled substance ... present in the person's body, as measured in the person's blood, urine, saliva, or other bodily substance." Though the expressed purpose of the law is to target and remove drug-impaired drivers from US roadways, the proposal would do nothing of the sort. Most troubling, the proposed law -- H.R. 3922 -- does not require motorists to be identifiably impaired or intoxicated in order to be criminally charged with the crime of "drugged driving." Rather, police have only to demonstrate that the driver has detectable levels of illicit drugs or inactive drug metabolites in their blood, sweat, saliva or urine. As many pot smokers know, marijuana metabolites are fat soluble, and remain identifiable in the urine for days and sometimes even weeks after past use. Consequently someone who smoked a joint on Monday could conceivably be arrested on Friday and charged with "drugged driving," even though they are perfectly sober! Here's how the law would work. Police, at their discretion, could order motorists during a traffic stop to undergo a drug test, most likely a urine test. If the driver's urine tests positive for prior pot use then he or she would automatically be charged and eventually found guilty of the criminal offense of driving under the influence of drugs -- even if the pot in question was consumed weeks earlier. Under the law, the fact that the driver is not impaired is irrelevant; the only "evidence" necessary is the positive test result. So Who's Behind This? Over the past five years, a small cabal of prohibitionists, drug testing proponents and toxicologists have pushed for legislation criminalizing drivers who operate a vehicle with inert drug metabolites present in their system. To date, their efforts have persuaded ten states -- Arizona, Georgia, Iowa, Illinois, Indiana, Minnesota, Pennsylvania, Rhode Island, Utah and Wisconsin -- to pass such "drugged driving" laws, known as zero-tolerance per se laws. Leading this charge is the Walsh Group, a federally funded organization that develops drug testing technology and lobbies for rigid workplace drug testing programs. Walsh Group President, Michael Walsh, is the former Director of the Division of Applied Research at the US National Institute on Drug Abuse (NIDA) and formerly served as the Associate Director of the Office of National Drug Control Policy (ONDCP), informally known as the Drug Czar's office In November 2002, the group partnered with the ONDCP to lobby state legislatures to amend their drugged driving laws. Every state has laws on the books prohibiting motorists from driving "under the influence" of a controlled substance. Like drunk driving laws, virtually all of these laws require the motorists to be impaired by their drug use in order to be charged with "drugged driving." Nevertheless, the Walsh Group argued that these existing laws are too lax on illicit drug users. To bolster their claim, they argued -- without explanation -- that actually linking illicit drug use to impaired driving is a "technically complicated and difficult task." Their solution? States should enact zero tolerance per se laws redefining "drugged drivers" as any motorist who tests positives for any level of illicit drugs or drug metabolites, regardless of whether their driving is impaired. "There is clearly a need for national leadership at the federal level to develop model statutes and to strongly encourage the states to modify their laws," the organization concluded in a widely disseminated report. Notably, the authors failed to mention that the widespread enactment of such a policy would be a political and financial windfall for the Walsh Group's drug testing technology and consulting services. The Walsh Group is hardly the only organization with something to gain from the Bush administration's proposed "drugged driving" crackdown. Speaking at a White House-sponsored symposium in February, former 1970s Drug Czar Robert Dupont -- another ex-NIDA director who now heads the workplace drug testing consultation firm Bensinger, Dupont & Associates (BDA) -- also demanded the federal government mandate zero-tolerance drugged driving laws. "Workplace drug testing has prepared us for drugged driving testing," Dupont told attendees, arguing that just as many public and private employees are subjected to random drug screening, so should be motorists. Those drivers who test positive, says Dupont, should then be monitored through regularly scheduled drug tests, including hair testing, for a period of two to five years. "The benefits of this approach will be improved highway safety," he concluded, failing to explain how punishing sober drivers while simultaneously lining BDA's pockets would make America's roadways any safer. Cruising on Cannabis: What's the Problem? "Driving under the influence of, or after having used, illegal drugs has become a significant problem worldwide," states the preamble to H.R. 3922. However, despite the government's claim, epidemiological evidence on the number of motorists who drive under the influence of illicit drugs is scarce. Further, among the limited evidence that does exist, much of it finds that pot's measurable yet relatively mild effects on psychomotor skills do not appear to play a significant role in vehicular crashes, particularly when compared to alcohol. "Crash culpability studies have failed to demonstrate that drivers with cannabinoids in the blood are significantly more likely than drug-free drivers to be culpable in road crashes," summarized researchers Gregory Chesher and Marie Longo in the recent book Cannabis and Cannabinoids: Pharmacology, Toxicology, and Therapeutic Potential. A 2002 Canadian Senate report was even more succinct, stating, "Cannabis alone, particularly in low doses, has little effect on the skills involved in automobile driving." Nonetheless, Congress' proposed bill specifically and disproportionately targets motorists who may occasionally smoke pot because marijuana's metabolites exit the body more slowly than other drug metabolites, often remaining detectable in urine for several weeks at a time. Equally troubling, there currently exists no technology that can accurately correlate drug metabolite concentration to impairment of performance. Of course, such concerns are no bother to those in Congress who intend to ride this latest wave of drug war rhetoric to reelection. Nor are they of much worry to those in the drug testing industry who stand to make a fortune prosecuting and jailing sober pot smokers. As for everybody else, be afraid; be very afraid. And be sure to keep a fresh sample of urine in the glove compartment. This article originally appeared in Heads Magazine in Canada. (c) 2004 Independent Media Institute. ------------------------ Yahoo! Groups Sponsor --------------------~--> Yahoo! Domains - Claim yours for only $14.70 http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0