July 2018 - cypherpunks-legacy

Donald Knuth stops paying for errata
by Perry E. Metzger 06 Jul '18

06 Jul '18

It seems that Donald Knuth had his bank accounts attacked not once but three times using his checking account number off of checks he sent out for bounties for flaws in his books and software, and is thus ending a practice of nearly 40 years. Rather sad. I mark this as another milestone in the slow destruction of the idea that it is okay for an account number to be the secret used to effect payment in a transaction system. http://www-cs-faculty.stanford.edu/~knuth/news08.html Perry -- Perry E. Metzger perry(a)piermont.com --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

CRYPTO-GRAM, March 15, 2011
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM March 15, 2011 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1103.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Anonymous vs. HBGary News Schneier News NIST Defines New Versions of SHA-512 ** *** ***** ******* *********** ************* Anonymous vs. HBGary One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs. HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica. In cyberspace, the balance of power is on the side of the attacker. Attacking a network is *much* easier than defending a network. That may change eventually -- there might someday be the cyberspace equivalent of trench warfare, where the defender has the natural advantage -- but not anytime soon. http://arstechnica.com/tech-policy/news/2011/02/anonymous-to-security-firm-… or http://tinyurl.com/5t35y7m http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-track… or http://tinyurl.com/6xhleht http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when… or http://tinyurl.com/4n8rohh http://arstechnica.com/tech-policy/news/2011/02/the-ridiculous-plan-to-atta… or http://tinyurl.com/4nv4jat http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside… or http://tinyurl.com/6579grz http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-… or http://tinyurl.com/6fw4s5u This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry. http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-0222… or http://tinyurl.com/48tgfee Stephen Colbert on HBGary: http://www.colbertnation.com/the-colbert-report-videos/375428/february-24-2… or http://tinyurl.com/46gaa9d http://www.colbertnation.com/the-colbert-report-videos/375429/february-24-2… or http://tinyurl.com/4p4zp3l Another article: http://www.h-online.com/security/features/Anonymous-makes-a-laughing-stock-… or http://tinyurl.com/63fekyp ** *** ***** ******* *********** ************* News Interesting article from Wired: "How a Remote Town in Romania Has Become Cybercrime Central." http://www.wired.com/magazine/2011/01/ff_hackerville_romania/all/1 Recently declassified: "Historical Study: The National Security Agency Scientific Advisory Board 1952b1963." http://www.governmentattic.org/4docs/NSA-SAB52-63_1965.pdf A physical biometric wallet: $825. http://www.dunhill.com/en-us/shoponline/leather/wallets/biometric-wallet-qg… or http://tinyurl.com/4f2f345 http://www.thetechherald.com/article.php/201105/6754/Dunhill-biometric-wall… or http://tinyurl.com/4n8v53e I don't think I understand the threat model. If your wallet is stolen, you're going to replace all your ID cards and credit cards and you're not going to get your cash back -- whether it's a normal wallet or this wallet. I suppose this wallet makes it less likely that someone will use your stolen credit cards quickly, before you cancel them. But you're not going to be liable for costs incurred during that delay in any case. Interesting story about a con man who conned the U.S. government, and how the government is trying to hide its dealings with him. http://www.nytimes.com/2011/02/20/us/politics/20data.html Susan Landau's testimony before the House Judiciary Committee, Subcommittee on Crime, Terrorism, and Homeland Security on government eavesdropping. http://judiciary.house.gov/hearings/hear_02172011.html The testimony of Valerie Caproni, General Counsel of the FBI, on the same topic. http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance… or http://tinyurl.com/46l49am Good article about the terrorist non-threat from Reason: http://reason.com/archives/2011/02/15/what-islamist-terrorist-threat "Reliably Erasing Data From Flash-Based Solid State Drives," by Michael Wei, Laura M. Grupp, Frederick E. Spada, and Steven Swanson. http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf News article: http://www.theregister.co.uk/2011/02/21/flash_drive_erasing_peril/ Video of talk: http://www.usenix.org/multimedia/fast11wei NIST has finally published its rationale for selecting the five SHA-3 finalists. http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Round2_Report_NI… or http://tinyurl.com/4zte3e2 Pickpocketing as a trade is dying out in America, because there's no one to train newer pickpockets in the craft. http://www.slate.com/id/2286010/pagenum/all/ Interesting research in using animals to detect substances. Basically, sniffer dogs respond to unconscious cues from their handlers, and generate false alarms because of them. It makes sense, as dogs are so attuned to humans. I'll bet bomb-sniffing bees don't make the same mistakes. http://www.economist.com/blogs/babbage/2011/02/animal_behaviour Full paper: http://www.springerlink.com/content/j477277481125291/fulltext.pdf Bomb-sniffing bees: http://www.livescience.com/4605-bees-trained-bomb-sniffers.html "American Cryptography During the Cold War 1945-1989; Book IV: Cryptologic Rebirth 1981-1989." Document was first declassified in 2009. Here are some newly declassified pages. http://www.governmentattic.org/4docs/NSA_AmerCryptColdWarBk4_1999.pdf http://www.governmentattic.org/4docs/oNSAAmerCryptColdWarBk4_1999.pdf Criminals are stealing cars by calling tow trucks. It's a clever hack, but an old problem: the authentication in these sorts of normal operations isn't good enough to prevent abuse. http://www.wsmv.com/news/26878155/detail.html A programmer installed malware into the Whack-a-Mole arcade game as a form of job security. It didn't work. http://www.wftv.com/news/26986709/detail.html Wired.com has a good three-part story on full-body scanners. http://www.wired.com/threatlevel/2011/02/scanners-part1/ http://www.wired.com/threatlevel/2011/03/scanners-part2/ http://www.wired.com/threatlevel/2011/03/scanners-part3/ Another attempt to sort out scanner claims: http://www.okianwarrior.com/MathView/BackscatterSafety/ Using language patterns to identify anonymous email. It only works when there's a limited number of potential authors. http://www.schneier.com/blog/archives/2011/03/using_language.html ** *** ***** ******* *********** ************* Schneier News I'm speaking at Black Hat Europe in Barcelona on March 17. http://www.blackhat.com/html/bh-eu-11/bh-eu-11-home.html I'm speaking at the Oracle Chief Security Officer Summit in New York City on March 30. http://www.oracle.com/us/dm/65212-wwmk09121721mpp414-se-281577.html This three-part video interview with me was conducted at the RSA Conference last month. http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528091… or http://tinyurl.com/4q9vt45 http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528245… or http://tinyurl.com/4dezbsk http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528160… or http://tinyurl.com/4bawfzq I was interviewed on chomp.fm. http://chomp.fm/008/ ** *** ***** ******* *********** ************* NIST Defines New Versions of SHA-512 NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster. This is a good thing, and exactly what we did in the design of Skein. We defined different outputs for the same state size, because it makes sense to decouple the internal workings of the hash function from the output size. http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf or http://tinyurl.com/47fta7g http://csrc.nist.gov/publications/PubsDrafts.html#fips-180-4 ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2011 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CRYPTO-GRAM, March 15, 2011
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM March 15, 2011 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1103.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Anonymous vs. HBGary News Schneier News NIST Defines New Versions of SHA-512 ** *** ***** ******* *********** ************* Anonymous vs. HBGary One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs. HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica. In cyberspace, the balance of power is on the side of the attacker. Attacking a network is *much* easier than defending a network. That may change eventually -- there might someday be the cyberspace equivalent of trench warfare, where the defender has the natural advantage -- but not anytime soon. http://arstechnica.com/tech-policy/news/2011/02/anonymous-to-security-firm-… or http://tinyurl.com/5t35y7m http://arstechnica.com/tech-policy/news/2011/02/how-one-security-firm-track… or http://tinyurl.com/6xhleht http://arstechnica.com/tech-policy/news/2011/02/virtually-face-to-face-when… or http://tinyurl.com/4n8rohh http://arstechnica.com/tech-policy/news/2011/02/the-ridiculous-plan-to-atta… or http://tinyurl.com/4nv4jat http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside… or http://tinyurl.com/6579grz http://arstechnica.com/tech-policy/news/2011/02/black-ops-how-hbgary-wrote-… or http://tinyurl.com/6fw4s5u This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry. http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-0222… or http://tinyurl.com/48tgfee Stephen Colbert on HBGary: http://www.colbertnation.com/the-colbert-report-videos/375428/february-24-2… or http://tinyurl.com/46gaa9d http://www.colbertnation.com/the-colbert-report-videos/375429/february-24-2… or http://tinyurl.com/4p4zp3l Another article: http://www.h-online.com/security/features/Anonymous-makes-a-laughing-stock-… or http://tinyurl.com/63fekyp ** *** ***** ******* *********** ************* News Interesting article from Wired: "How a Remote Town in Romania Has Become Cybercrime Central." http://www.wired.com/magazine/2011/01/ff_hackerville_romania/all/1 Recently declassified: "Historical Study: The National Security Agency Scientific Advisory Board 1952b1963." http://www.governmentattic.org/4docs/NSA-SAB52-63_1965.pdf A physical biometric wallet: $825. http://www.dunhill.com/en-us/shoponline/leather/wallets/biometric-wallet-qg… or http://tinyurl.com/4f2f345 http://www.thetechherald.com/article.php/201105/6754/Dunhill-biometric-wall… or http://tinyurl.com/4n8v53e I don't think I understand the threat model. If your wallet is stolen, you're going to replace all your ID cards and credit cards and you're not going to get your cash back -- whether it's a normal wallet or this wallet. I suppose this wallet makes it less likely that someone will use your stolen credit cards quickly, before you cancel them. But you're not going to be liable for costs incurred during that delay in any case. Interesting story about a con man who conned the U.S. government, and how the government is trying to hide its dealings with him. http://www.nytimes.com/2011/02/20/us/politics/20data.html Susan Landau's testimony before the House Judiciary Committee, Subcommittee on Crime, Terrorism, and Homeland Security on government eavesdropping. http://judiciary.house.gov/hearings/hear_02172011.html The testimony of Valerie Caproni, General Counsel of the FBI, on the same topic. http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance… or http://tinyurl.com/46l49am Good article about the terrorist non-threat from Reason: http://reason.com/archives/2011/02/15/what-islamist-terrorist-threat "Reliably Erasing Data From Flash-Based Solid State Drives," by Michael Wei, Laura M. Grupp, Frederick E. Spada, and Steven Swanson. http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf News article: http://www.theregister.co.uk/2011/02/21/flash_drive_erasing_peril/ Video of talk: http://www.usenix.org/multimedia/fast11wei NIST has finally published its rationale for selecting the five SHA-3 finalists. http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/documents/Round2_Report_NI… or http://tinyurl.com/4zte3e2 Pickpocketing as a trade is dying out in America, because there's no one to train newer pickpockets in the craft. http://www.slate.com/id/2286010/pagenum/all/ Interesting research in using animals to detect substances. Basically, sniffer dogs respond to unconscious cues from their handlers, and generate false alarms because of them. It makes sense, as dogs are so attuned to humans. I'll bet bomb-sniffing bees don't make the same mistakes. http://www.economist.com/blogs/babbage/2011/02/animal_behaviour Full paper: http://www.springerlink.com/content/j477277481125291/fulltext.pdf Bomb-sniffing bees: http://www.livescience.com/4605-bees-trained-bomb-sniffers.html "American Cryptography During the Cold War 1945-1989; Book IV: Cryptologic Rebirth 1981-1989." Document was first declassified in 2009. Here are some newly declassified pages. http://www.governmentattic.org/4docs/NSA_AmerCryptColdWarBk4_1999.pdf http://www.governmentattic.org/4docs/oNSAAmerCryptColdWarBk4_1999.pdf Criminals are stealing cars by calling tow trucks. It's a clever hack, but an old problem: the authentication in these sorts of normal operations isn't good enough to prevent abuse. http://www.wsmv.com/news/26878155/detail.html A programmer installed malware into the Whack-a-Mole arcade game as a form of job security. It didn't work. http://www.wftv.com/news/26986709/detail.html Wired.com has a good three-part story on full-body scanners. http://www.wired.com/threatlevel/2011/02/scanners-part1/ http://www.wired.com/threatlevel/2011/03/scanners-part2/ http://www.wired.com/threatlevel/2011/03/scanners-part3/ Another attempt to sort out scanner claims: http://www.okianwarrior.com/MathView/BackscatterSafety/ Using language patterns to identify anonymous email. It only works when there's a limited number of potential authors. http://www.schneier.com/blog/archives/2011/03/using_language.html ** *** ***** ******* *********** ************* Schneier News I'm speaking at Black Hat Europe in Barcelona on March 17. http://www.blackhat.com/html/bh-eu-11/bh-eu-11-home.html I'm speaking at the Oracle Chief Security Officer Summit in New York City on March 30. http://www.oracle.com/us/dm/65212-wwmk09121721mpp414-se-281577.html This three-part video interview with me was conducted at the RSA Conference last month. http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528091… or http://tinyurl.com/4q9vt45 http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528245… or http://tinyurl.com/4dezbsk http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1528160… or http://tinyurl.com/4bawfzq I was interviewed on chomp.fm. http://chomp.fm/008/ ** *** ***** ******* *********** ************* NIST Defines New Versions of SHA-512 NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster. This is a good thing, and exactly what we did in the design of Skein. We defined different outputs for the same state size, because it makes sense to decouple the internal workings of the hash function from the output size. http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf or http://tinyurl.com/47fta7g http://csrc.nist.gov/publications/PubsDrafts.html#fips-180-4 ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2011 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

effectively prevent computer radiation
by shenzhen xiongfeng 06 Jul '18

06 Jul '18

In the modern society, the computer has already become an essential tool for the people to live and work. While it brings many conveniences to the people, it also brings some worries and anxieties, especially computer radiation, which does much harm to human body. Through more than one year' study and research, Xiongfeng Technology Cor., Ltd explores the first generation high-tech product -- FANGFUWANG. FANGFUWANG makes full use of its powerful absorption so that it can effectively absorb any kind of electromagnetic wave (radiation) and prevent the disease caused by radiation. The main material of FANGFUWANG is active nanometer bamboo carton. Through Chinese and Japanese experts' many years research and repeatedly proof, the nanometer bamboo carbon has the characteristics of being close and porous, and having strongly absorbable capacity. The characteristics of FANGFUWANG's design are natural, environmental protection, convenient, which is not only taken as the interior decoration, but also used extremely convenient. If you want to know more details, you can open the Xiongfeng Technology's website at www.hkxf.com. In our website, there are our product detailed instructions and test experiment, welcome to watch. Now our company is looking for agents in the world who are interested in our products, and we are looking forward to your sincere cooperation. SHENZHEN XIONGFENG TECHNOLOGY CO.,LTD Add: 2-9F,Shenzhen Wanpan Garden, Nanshan Area, Shenzhen City, Guangdong Province, China. Tel:86-755-26000105 Fax:86-755-26000144 -----

1 0

[i2p] weekly status notes [apr 5]
by jrandom 06 Jul '18

06 Jul '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi y'all, time for the weekly update * Index 1) 0.5.0.5 2) Bayesian peer profiling 3) Q 4) ??? * 1) 0.5.0.5 Last week's 0.5.0.5 release has had its ups and downs - the major change to address some attacks in the netDb seems to work as expected, but has exposed some long overlooked bugs in the netDb's operation. This has caused some substantial reliability issues, especially for eepsites. The bugs have however been identified and addressed in CVS, and those fixes among a few others will be pushed out as a 0.5.0.6 release within the next day. * 2) Bayesian peer profiling bla has been doing some research into improving our peer profiling by exploiting simple bayesian filtering from the gathered stats [1]. It looks quite promising, though I'm not sure where it stands at the moment - perhaps we can get an update from bla during the meeting? [1] http://forum.i2p.net/viewtopic.php?t=598 http://theland.i2p/nodemon.html * 3) Q There is lots of progress going on with aum's Q app, both in the core functionality and with a few people building various xmlrpc frontends. Rumor has it we might be seeing another Q build out this weekend with a whole slew of goodies described on http://aum.i2p/q/ * 4) ??? Ok, yeah, very brief status notes, as I got the timezones mixed up *again* (actually, I got the days mixed up too, thought it was Monday until a few hours ago). Anyway, there is lots of stuff going on not mentioned above, so swing on by the meeting and see whats up! =jr -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFCUvNtWYfZ3rPnHH0RAlzmAKCAX5PQP8s2wWIxhWnHWG6eeps1nQCffkNC Li2s44HU5EehnMoCMxIOZlc= =WNZp -----END PGP SIGNATURE----- _______________________________________________ i2p mailing list i2p(a)i2p.net http://i2p.dnsalias.net/mailman/listinfo/i2p ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

[IP] Proposed Surveillance Bill Would Sweep NSA Spying Programs Under the Rug
by David Farber 06 Jul '18

06 Jul '18

Electronic Frontier Foundation Media Release For Immediate Release: Friday, July 14, 2006 Contact: Kevin Bankston Staff Attorney Electronic Frontier Foundation bankston(a)eff.org +1 415 436-9333 x126 Kurt Opsahl Staff Attorney Electronic Frontier Foundation kurt(a)eff.org +1 415 436-9333 x106 Lee Tien Senior Staff Attorney Electronic Frontier Foundation tien(a)eff.org +1 415 436-9333 x102 Proposed Surveillance Bill Would Sweep NSA Spying Programs Under the Rug Bill Threatens Future of EFF Case and Other Legal Challenges San Francisco - Senate Judiciary Committee Chairman Arlen Specter said today that he has negotiated a proposed bill with the White House regarding the NSA's illegal spying program. While the final bill is not public, a draft of the bill obtained by the Electronic Frontier Foundation (EFF) is a sham compromise that would cut off meaningful legal review -- sweeping current legal challenges out of the traditional court system and failing to require court review or congressional oversight of any future surveillance programs. "This so-called compromise bill is not a concession from the White House -- it's a rubber stamp for any future spying program dreamed up by the executive," said EFF Staff Attorney Kevin Bankston. "In essence, this bill threatens to make court oversight of electronic surveillance voluntary rather than mandatory." Although the bill creates a process for the executive branch to seek court review of its secret surveillance programs, it doesn't actually require the government to do so. The bill would, however, require that any lawsuit challenging the legality of any classified surveillance program -- including EFF's class-action suit against AT&T -- be transferred, at the government's request, to the FISA Court of Review, a secret court with no procedures for hearing argument from anyone but the government. The bill would further allow the government to prevent the court from disclosing any information about the government's surveillance programs to opposing counsel, regardless of the court's strict security procedures. "When the privacy of millions of Americans is at stake, we deserve more than a closed hearing by a secret court," said EFF Senior Staff Attorney Lee Tien. For the draft of the Specter bill: http://www.eff.org/Privacy/Surveillance/NSA/specter_draftbill_071306.pdf For this release: http://www.eff.org/news/archives/2006_07.php#004824 About EFF The Electronic Frontier Foundation is the leading civil liberties organization working to protect rights in the digital world. Founded in 1990, EFF actively encourages and challenges industry and government to support free expression and privacy online. EFF is a member-supported organization and maintains one of the most linked-to websites in the world at http://www.eff.org/ -end- _______________________________________________ presslist mailing list https://falcon.eff.org/mailman/listinfo/presslist ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

FC: Democrats' new "bio" bill links police to SABRE, Amtrak systems
by Declan McCullagh 06 Jul '18

06 Jul '18

A more detailed summary of the Bioterrorism Protection Act is available here --- final bill has not been written yet -- though the pages are not sequential, so it's only for the brave: http://vorlon.mit.edu/~declan/biobill/ Excerpts from that summary: * "Evaluate need to vaccinate first responders against smallpox" * "Utilize biometric techniques to identify suicide-biological-bombs" * "Increase surveillance through development of sentinel strain. Create a network of interconnected databases for near-real time integration of threat indicator data" * "Establish a perception management and economic market mitigation plan and resources" * "Ensure isolated, genetically diverse pools of seed and livestock to replenish stocks destroyed in disease containment" * "Assess and harden physical security of water-bottling facilites" * "The handoff between intelligence and law enforcement agencies must be made smoother" * "Use GPS and wireless identification systems to monitor commercial traffic in high-risk and border areas" * "Ensure that private databases (SABRE, Amtrak reservations, etc.) are able to interface with law enforcement information stores immediately" -Declan ******** http://www.wired.com/news/conflict/0,2100,47898,00.html Dems Ready Bioterrorism Bill By Declan McCullagh and Ben Polen 2:00 a.m. Oct. 26, 2001 PDT WASHINGTON -- In an attempt to differentiate themselves from their GOP counterparts, House Democrats are preparing legislation they say will shield America from biological terrorism. As anxieties about anthrax mushroomed on Capitol Hill -- with the deadly bacteria discovered in five congressional office buildings so far -- House Minority Leader Richard Gephardt (D-Missouri) said Thursday that new spending and police powers are necessary to protect the public. At a press conference held in the open air away from any of the polluted buildings, Gephardt said his "Bioterrorism Protection Act" would earmark $7 billion for homeland security -- including $1.4 billion on vaccines and antibiotics -- and provide police with instant access to private databases such as the airline's SABRE system and Amtrak reservations. [...] ******** http://menendez.house.gov/speaks/viewrelease.cfm?id=337 HOMELAND SECURITY TASK FORCE CHAIRMAN MENENDEZ ANNOUNCES BIOTERRORISM LEGISLATION WASHINGTON, DC - Rep. Bob Menendez (D-NJ), Vice Chair of the Democratic Caucus and Chairman of the House Democratic Task Force on Homeland Security, joined by Democratic Leader Richard Gephardt and Members of the Task Force, today announced the Democratic proposal to protect communities throughout America against future bioterrorist threats or attacks. The Democratic Bill, the Bioterrorism Protection Act (BioPAct) of 2001, seeks to eliminate biological threats, secure our borders on land and at sea, protect our food and water, equip our communities with the resources to prevent and respond to bioterrorism, and strengthen our Intelligence through full coordination, using our most advanced technology to fight bioterrorism. Menendez made the following remarks: "I'm Bob Menendez, the Chairman of the House Democratic Task Force on Homeland Security, and I first want to thank the chairs and vice chairs of the working groups that helped write this plan: Bill Pascrell, Sanford Bishop, Bobby Scott, Jane Harman, Ike Skelton, Bob Borski, Lucille Roybal-Allard, Ellen Tauscher, Sheila Jackson-Lee, Mike Honda, Jim Turner, and Jerry Costello - and I want to thank the incredible work of over 80 Members of our Task Force on this bill. These aren't just Members of Congress, they're husbands and wives, mothers and fathers, working to make our country and their communities safe and secure. And I think they've done a great job. "What we've learned in the last few weeks is that no matter what we as a people are confronted with, we will overcome and defeat our adversaries. No attack, no threat, no evil will undermine our resolve and our strength. America stands proud and firm - our country and our people have served as an example to all of humanity. America has reacted to this unspeakable inhumanity with resiliency & humanity - humanity in the face of evil. "We call the Bioterrorism Protection Act "BioPAct" because we know that every American needs to be a part of the fight, part of a pact to protect our Homeland. And if we're asking the public to be 'vigilant', then they need and deserve to be informed in full and given the chance to be a part of a dialogue with the officials who work for them. This bill does that. (more) "BioPAct is a pact between the American people and their government, working together, called to national service, marshaling our vast resources, to keep America safe from bioterrorism. The plan doesn't just draw on government programs, but on the American spirit, intellect & creativity, breaking new frontiers, setting an example the world can follow in this new age. "We're here to tell our fellow citizens that we can beat this foe - and we can protect our Homeland. "The BioPAct will proactively assess the new threats and risks we face, so we make sure we target our funding where it's needed most. It will eliminate biological threats at the source, by helping countries like Russia and the other former Soviet states prevent their biological agents from getting into our enemies' hands. We will secure our borders on land and at sea by adding thousands of new border agents and by putting our most advanced technology at work to screen out terrorists and the weapons they might try to bring with them - whether they try to enter our nation at airports, on ships, by foot, or in a car. And BioPAct will keep our food and water supply safe and secure by putting a comprehensive new inspection protocol in place. "We will make sure our local communities have all the resources they need - from greater hospital capacity, to police and firefighters trained in counter-terrorism. "We can prevent disease outbreaks through early and rapid detection; and can save lives by making sure we have the vaccines and medicines to treat people - and a plan in place to get them where they need to go on a moment's notice. This bill does that. And BioPAct strengthens our Intelligence by ensuring our many government agencies coordinate information and planning. We need one comprehensive strategy - not a dozen different ones. "This bill is a commitment to do all this, and a lot more - because we know there is nothing more important than keeping American families safe. "This is the first in a series of proposals this Task Force and we Democrats in the House are putting forward to address Homeland Security. My colleagues and I look forward to working with the President and the Republicans to get the job done - in fact we met with Director Ridge yesterday, and I'm confident we can work together as one American team. "And as part of that team effort, we also call on the President to use the funding already allocated to fight terrorism to begin a national threat assessment; to help local communities cover the unexpected overtime costs they have already borne in response to the new threat environment since September 11th; and to rapidly dedicate new resources to our Coast Guard, our border security, and our postal service. We can and will protect our Homeland. "I'm now proud to introduce our Democratic Leader, Dick Gephardt, who had the foresight early on to work with our Caucus Chairman, Martin Frost, to create this Task Force - bringing so many Members together to work on an issue that's on the mind of every American. He's been an inspiration to this Congress and to our nation - Ladies and Gentlemen: Dick Gephardt - "Thank you." Executive Summary of the BioPAct: HOUSE DEMOCRATIC CAUCUS HOMELAND SECURITY TASK FORCE THE BIOTERRORISM PROTECTION ACT (BioPAct) of 2001 A $7 Billion Pact with America Public Health Infrastructure and Response to Bioterrorism ($3.5 billion) Improving Community Emergency Response Capacity and Preparedness -- $1 billion Increasing hospital capacity, educating medical personnel, increasing nursing and clinical lab personnel, and providing training to first responders. Ensuring an Adequate Supply of Vaccines and Treatments for All Americans -- $1.4 billion Increasing the national stockpile of anthrax antibiotics, developing and acquiring additional doses of smallpox vaccines, researching and developing new vaccines and antibiotics, training and equipping health professionals to provide antibiotics and vaccines, and expediting FDA approval of new products. Enhancing Community Planning and Intergovernmental Coordination -- $600 million Providing planning grants to local communities and health care providers to develop emergency response plans that meet certain minimum federal guidelines, requiring states to submit medical response plans to the federal government, funding state trauma care systems, and strengthening intergovernmental coordination. Enhancing Surveillance, Improving Communications, and Strengthening Technology Infrastructure -- $500 million Improving state and local surveillance, training health care personnel in the detection of illnesses related to biological attacks, upgrading laboratories, ensuring a 24-hour public health system is available to local providers, improving and expanding CDC surveillance capabilities, building local technology and communication systems, enhancing communications among agencies, and requiring state and federal agencies to share with first responders important information about the potential dangers of an emergency site. Protecting Our Food And Water ($800 million) Keeping Our Food Safe -- $725 million Protecting crops and livestock through increased surveillance and research, strengthening both physical and information security at key agricultural facilities, increasing inspections of imported food shipments with additional inspectors, increasing the inspections of domestic production plants, coordinating and testing federal emergency response plans, and helping states track foodborne agents. Keeping Our Water Supply Safe -- $75 million Reviewing emergency preparedness and vulnerabilities of water systems, providing resources to address deficiencies in security, developing improved monitoring systems to track water quality, improving security of information systems, improving security of water-bottling facilities, and implementing background checks for quality testers at treatment plants and bottling facilities. Enhancing Law Enforcement's Ability to Protect the Nation ($870 million) Providing the right tools to law enforcement agencies -- $275 million Expanding federal authority over biological agents and toxins; establishing new criminal offenses involving the possession and unsafe handling of biological agents; developing and deploying new screening hardware, software, computer infrastructure, and training to support biometric technology; creating new COPS grants to local communities for counter-terrorism training and equipment; giving grants to local governments for strategic planning and intergovernmental coordination related to terrorism preparedness and response; providing funds to eliminate the backlog of convicted offender DNA samples yet to be entered in the FBI database. Securing Our Borders at Land and Sea -- $345 million Increasing the size of the United States Border Patrol Force and the number of INS and Customs Inspectors at ports of entry; implementing biometric scanning techniques at border checkpoints; funding development and deployment of scanning technology capable of detecting explosive devices, biological and chemical contaminants; mandating better INS tracking of visas and integrating visa monitoring with federal watch lists; providing Coast Guard with enhanced training and equipment. Addressing Threats to Mail Delivery Services -- $250 million Developing and deploying faster scanning technologies, implementing improved mail tracking abilities to track suspicious packages to their source, and investigating procedures to treat mail and mitigate threats posed by contaminated mail. Strengthening Our Intelligence Through Full Coordination ($1.1 billion) Improving Organization and Coordination of Intelligence Community -- $270 million Conducting a threat assessment to identify vulnerabilities and provide a basis for a national strategy for homeland security; removing barriers to efficient information sharing between intelligence collection and information use by law enforcement and first responders; conducting a public education campaign to alert Americans to the threat and appropriate responses for biological weapons. Improving Intelligence Capabilities -- $850 million Deploying biological and chemical detectors for site analysis, continual surveillance of fixed sites, and improved identification of foreign biological agent possession; increasing language translation skills and improving usage of language resources across agencies; increasing human intelligence assets. The Military: Preparing, Responding & Assisting Communities ($720 million) Initial Crisis Response and First Responder Support -- $420 million Increasing military domestic crisis response teams, creating and training additional Civil Support Teams, and training and equipping military and civilian emergency responders with interoperable communications equipment. Interagency Crisis and Consequence Management Exercises -- $100 million Implementing a uniform government-wide evaluation system to ensure proficiency and achievement of military domestic crisis response, increasing training of military personnel for response to weapons of mass destruction incidents, and increasing resources for military involvement in consequence and crisis management exercises. Research and Development -- $100 million Accelerating technology development in chemical and biological research (prevention and treatment), advanced sensors, and other promising technologies. Cooperative Threat Reduction (Nunn-Lugar) -- $100 million Securing the supply of biological and chemical weapons-grade material from the former Soviet Union, improving Russian and former Soviet Union border and export controls, and increasing support for the Material Protection, Control and Accounting Program. ### ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

[p2p-research] Never Mind the Policy: Can Filtering Technology Stop p2p?
by Tomas Rawlings 06 Jul '18

06 Jul '18

Source: http://blog.catbot.org/content/never-mind-policy-can-filtering-technology-s… There is another story in the media about the ongoing debate about what (if anything) the government should be doing in response to online piracy; A rift has opened between music's creators and its record labels, with a broad alliance of musicians, songwriters and producers fiercely criticising the business secretary Lord Mandelson's plans to cut off the broadband connections of internet users who illegally download music. What I find interesting about the coverage is that there is little to no discussion about if such measures are possible. By that I mean, is the technology there to accurately stop piracy b so, assuming you had robust legislation giving a clear definition of what was to be done b is the tech there to do it? There is no doubt that some technologies exist, but I suspect that there are serious limits to what it can achieve. For starters, any technology solution would need to have some or all of the following to be practical: * Easy to implement b The network ecology that this technology is coming into is dynamic, thus if the technology takes time to implement, then the conditions may have changed and rendered the tech obsolete. * Low bandwidth b if the process of checking all the traffic is taking too much out of the network, it is going to impact on the service that people will have paid for b as well as penalising all users, regardless of if they are indulging in non-legitimate uses. * Discriminatory - Able to discriminate between legitimate and non-legitimate traffic accurately. If it targets the wrong people, it is going to cost time, money and reputation for the ISPs involved. * Decryptory b There has been marked rise in encrypted p2p technology of late. This means that any system will need to deal with not only encrypted peers, but also encrypted packets of data. Now those are the 'easy' points b the obvious ones that the technology would need. From the p2p research I've been doing, I would suggest that there are a couple of other ones of note too: * 100% Effective b One key thing about internet ecology is that it is very, very easy for users to change p2p software. Users can also communicate virally, so can pass information on about holes in any system rapidly. The exploitation of the loop-holes will also be viral. This means a 99.9% effective system upon implementation will rapidly become a 0% one. * Psychic b The other issues is that once a flag goes up, there will be many, many people trying many many methods to by-pass the system. This will be continuous and will consist of lines of attack from new directions. The system implemented need to anticipate and head-off these attacks to stay in-the-game. I am being a little provocative in the points above, but I feel they are valid. I think you see what I am saying b stopping online piracy is very, very difficult. Some may point to the Great Firewall of China as a successful example of internet control b forgetting that it is backed by an authoritarian state and might not be effective for all we know b became its failings are not going to be publicised either by the government there or the users who've found a way though. - Tomas ----------------------- Tomas Rawlings Development Director, FluffyLogic Development Ltd. web: www.fluffylogic.net tel: 0117 9442233 - Also see: blog on film & interweb: www.plugincinema.com blog on p2p, media ecology & evolution: blog.catbot.org tweet: www.twitter.com/arclightfire _______________________________________________ p2presearch mailing list p2presearch(a)listcultures.org http://listcultures.org/mailman/listinfo/p2presearch_listcultures.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[p2p-hackers] [Fwd: [Planetlab-users] Announcing: TCP NAT Traversal/Hole-Punching Library]
by Michael Parker 06 Jul '18

06 Jul '18

I just got this by way of the PlanetLab mailing list... Definitely thought it would be of interest! - Mike ---------------------------- Original Message ---------------------------- Subject: [Planetlab-users] Announcing: TCP NAT Traversal/Hole-Punching Library From: "Saikat Guha" <saikat(a)cs.cornell.edu> Date: Wed, September 28, 2005 3:46 am -------------------------------------------------------------------------- Hi all, (apologies if you get multiple copies of this) I am pleased to announce the availability of our open-source TCP NAT Traversal/Hole-Punching library based on our research published in [1]. [1] "Characterization and Measurement of TCP Traversal through NATs and Firewalls", S. Guha and P. Francis. IMC 2005. http://nutss.net/pub/imc05-tcpnat.pdf The key result of the paper is: TCP NAT traversal can work 85%-90% of the time today (without any special assumptions about NATs), and 100% of the time between pairs of certain popular, well-behaved NATs. See [1] for more details. An open-source Java library for TCP NAT Traversal is now available: webpage: http://nutss.net/stunt.php faq: http://nutss.net/jstunt-faq.php library and example: http://nutss.net/jstunt-examples.php The above library has been tested for pair-wise connectivity across 11 brands of NATs from Windows and Linux hosts. NATs tested were Linksys, DLink, Netgear, Belkin, 3Com, Netopia, Allied Telesyn, SMC, Trendnet, USR, Buffalo Tech. Out of the 121 possible pair-wise combinations, 113 connections are successful. The only ones that failed are when both the endpoints are behind the _same_ NAT device that does not support TCP hairpin-behavior yet (see [1]). The java library is released under LGPL; contact me if this does not meet your needs. Feel free to extend it/port it etc. Q: I am a P2P developer/researcher. How does this help me? A: The library adds TCP NAT traversal out-of-the-box. This increases the connectivity in your P2P network since two users behind their NATs can now exchange data without having to go through an intermediary node. You can: - Use this library as is (for development of P2P software, research, small deployments, etc in java) - Study it to provide TCP NAT Traversal in your existing P2P applications in your language of choice. - etc. If you have any questions, comments, suggestions, or problems, do not hesitate to contact me. Cheers, -- Saikat _______________________________________________ Users mailing list: Users(a)lists.planet-lab.org https://lists.planet-lab.org/mailman/listinfo/users ----- End forwarded message ----- _______________________________________________ Gnucla-devel mailing list Gnucla-devel(a)starsky.ee.ucla.edu http://starsky.ee.ucla.edu/cgi-bin/mailman/listinfo/gnucla-devel _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

DC speaking event: Bruce Schneier on "The Future of Privacy"
by Stanley, Jay 06 Jul '18

06 Jul '18

Dave, Washington, DC-area IPers may be interested in attending this talk we're sponsoring by Bruce Schneier on "the Future of Privacy" on Tuesday. Our invite is below. Best, Jay ~~~~~~~~~~~ Jay Stanley Public Education Director, Technology and Liberty Project ACLU Bruce Schneier to speak on "The Future of Privacy" Tuesday You are cordially invited to an exciting opportunity to hear the renowned security expert, technologist, cryptographer, author and thinker Bruce Schneier discuss "The Future of Privacy," sponsored by the ACLU. The recent NSA spying scandal is just the latest sign of our times - how rapidly evolving technology is opening up new possibilities for surveillance, and how governments and companies are rushing to exploit them. With his unique background, Bruce Schneier is positioned to offer a fascinating and insightful perspective on the future of privacy in America at a time of churning technological change. This talk and discussion also kicks off of an exciting new ACLU speaking series, The Forum on Technology & the Future, which will feature experts discussing and debating cutting-edge technologies and their implications for the future of civil liberties. Events will be held on a roughly bi-monthly basis in Washington DC (a schedule is available on the ACLU website at www.aclu.org/future) Looking forward to seeing you there, Barry Steinhardt ---------------------------------------------------------- Bruce Schneier, "The Future of Privacy" Sponsored by the ACLU's Forum on Technology and the Future Tuesday, May 23 9:30 AM Coffee and muffins served starting at 9:00 915 15th St. NW, Washington DC, 6th Floor It is requested but not required that you RSVP to futurefreedom(a)aclu.org Bruce Schneier is an internationally renowned security technologist, referred to by The Economist as a "security guru." He is the author of eight books - including the best sellers "Beyond Fear: Thinking Sensibly about Security in an Uncertain World," "Secrets and Lies," and "Applied Cryptography" - and hundreds of academic articles and papers. His influential newsletter, Crypto-Gram, is read by over 120,000 people. Schneier is regularly quoted in the press, and his essays have appeared in national and international publications. He is the CTO and founder of Counterpane Internet Security, Inc., and the author of the popular Blowfish and Twofish encryption algorithms. He is also a frequent guest on television and radio, has testified before Congress, and is a frequent writer and lecturer on issues surrounding security and privacy. ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0