- cypherpunks-legacy - lists.cpunks.org

Re: [tor-talk] Tor and HTTPS graphic
by coderman 06 Jul '18

06 Jul '18

On Mon, Mar 12, 2012 at 11:57 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > ... > Your ideas intrigue me and I wish to subscribe to your newsletter. my last comment for this sad, confused tangent of a thread; it has been accosted via conjecture with too much frequency *grin* SCTP for congestion control of transparent proxy TCP/UDP traffic. local classification of traffic allocates by protocol / use fairness instead of aggregate tcp fairness. like bittorrent or aria2 parallel traffic treated as distinct low priority unit of traffic, deferring to higher priority low latency web traffic and messaging. multi-homing / multi-path endpoints in SCTP would maintain concurrent connection with distinct endpoints, avoiding predecessor, timing, denial of service attacks present in reliable, ordered, single stream transports. edges would be screwed as you mention, unless they were full fledged participants consistently. using a UDP based transport with LEDBAT or other technique to keep broadband upstream unsaturated and unclogged (no deep queues), allowing all broadband endpoints the ability to contribute to a large shared network. ORCHID IPv6 addressing with IPsec tunnels is intended to re-use existing work, including well tested auth+privacy with datagram padding in IPsec. SCTP+TLS would fit over top of IPv6 ORCHID endpoints (using IPsec SAs) to transport signalling/keying and encapsulated client traffic. part of this would also include lowest priority (lossy reliable) SRMP type delivery of useful, less immediate information to nodes. to some extent the ORCHID addresses could be thought of as hidden service names and also circuit endpoints for a given IPsec tunnel. this set of: a. critical signalling and keying traffic b. high priority, interactive web traffic and messaging c. lower priority bulk traffic, downloads, streaming media d. best effort, latent bulk caching and exchange are the classful shaping groups ordered inside of opaque SFQ outbound queues at various improved/concurrent stratified dependent link padding paths of IPsec telescopes carrying intermediate hop(signalling) and bearer traffic. combining better prioritization of traffic and consistent consumption of traffic (deferring low priority packets and using opportunistic caching strategies for network information respectively) obtains the best performance out of the SFQ DLP paths with the lowest latency for priority traffic. still, so many details left as exercise for the reader ;) > Do free reference implementations exist for all of these protocols? sort of, for only parts; if you want a portable user space implementation (or port) it's all custom. the joys of wild conjecture include absurd timelines and technical effort for free... rump is about as close as i've seen: http://www.netbsd.org/docs/rump/index.html this is not the least of "how to deploy a thing like this" concerns. there is also no backward compatibility or slow transition from an existing Tor network to something using UDP encapsulated IPsec telescopes (even if TCP can be transparently proxied over SCTP over this). _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: Do Cryptographers burn?
by Hadmut Danisch 06 Jul '18

06 Jul '18

On Sat, Apr 03, 2004 at 11:49:15PM +0100, Dave Howe wrote: > > If you mean he gave a false assurance of the security of a product for a > friend - why would he do that? I can't think of any of my friends who would > want me to tell them sofware was secure if it wasn't. ... > I suppose that depends on his integrity and how much his reputation and > skill would be worth to his employers if it became known that he gave false > assurances - and it would only be a matter of time before some other > cryptoanalyst found the fault he found and ignored. Thanks for the opinions. Maybe I'll explain a little bit more about the background: As some already may have heard I'm in a legal dispute with a german University. I wrote a dissertation in 1998, and the supervisor announced to give a good rate. I then signed off from the job as an assistant effectively to the date of the examination. I didn't know that the supervisor and another professor had made a plan to implement a security infrastrukture for the faculty and to found a company, and that this plan included that I would do the work in the year after the examination. When I signed off, they couldn't fulfill the promises they gave to the faculty, and thus canceled the examination to extort me to stay at the university and do the implementation. I refused to pay that kind of "protection money" and thus they rejected my dissertation with false expertises. The advisor's expertise (who claims to be one of the world's top cryptographers) is just a concatenation of arbitrary nonsense, and wrong even in the basics of computer science. E.g. he claims that LZ and MTF would effectively compress just anything. As an example for the need to distinguish between payload and control information I said that when phoning, not only speech is to be transmitted, but also phone numbers and signals about termination of the connection. He rated this as completely wrong and giving wrong information, because phone numbers would be used with today's ISDN Telephones only. As the reason he gave an obituary in the London Times saying that Donald Davies had died. Or he blames me for not citing literature that hadn't been published when I submitted the dissertation. He claims that rate-distortion theory and shannon encoding allow to pack n+1 independant bits into a single message of n bits (even with small n or n=1. Just try to do it.). The second examiner said the dissertation would be completely wrong but denied to give any explanation. I filed a lawsuit. During the law suit, the university had informed me, that they would never accept me to succeed in the examination. They would abuse a gap in german examination law: courts are restricted to cancel bad or wrong examinations, but they cannot give a positive examination result. All they can do is to sentence the University to repeat the examination. The University informed me that they had decided that they do not wish me to work in science and thus I had to accept to fail in the examination. I would have to modify my dissertation and to include those mistakes the examiners had falsely claimed in order to confirm that their rejection was correct. If I do that I would be allowed to have a second try with a new dissertation and would receive a bad grade which would keep me out of science. If I do not agree, they announced to keep me in an endless loop of false expertises. Every single one will take me years to sue against. I refused that "deal". I won both at the administration court and the appelate administration court. The latter one found that the second examiner could never have read the largest chapter and didn't even open the pages of the dissertation. This was already sufficient to cancel the examination action. The University then retracted the action to avoid being sentenced. Obviously, this was an extreme disgrace for the University. The University had to give a new second expertise. If this expertise could not confirm what the first expertise said, that the dissertation was completely wrong, the advisor would face beeing fired, severe compensation claims, and the ultimate disgrace. Within less then two weeks the University managed to get a third rejecting expertise, this time from a professor outside Germany, who is indeed known as one of the top cryptographers and a member of the board of directors of the IACR. I filed a new lawsuit and could easily prove that this professor had intentionally given a wrong expertise (obviously to protect the supervisor from legal trouble): - He wrote the expertise in less than two days. - The expertise is less than a page. He does not give any reasons and claims that he cannot be expected to reason his expertise. Reasoning is a strong requirement under german law. - There is no "link" between the expertise and the dissertation. He obviously didn't read it. - He didn't find any single mistake. He just says that everything is already known and taken from literature. - He didn't bother to inform himself about the given problem, the legal requirements, and the available grades. That's a strong requirement in Germany. Obviously, if someone accepts to write an expertise and in advance knows that he won't need grades, then he knows that he will reject the dissertation before he has seen it. - And he erroneously assumed that the expertise would be kept secret. In Germany, the examinee has the right to get a copy of the expertise and raise objections. He was not aware of this and based his expertise on the assumption that nobody would see it. I then raised several technical and legal objections, and cited literature which explicetly stated that such subjects have not yet been published. - He then had to admit that he couldn't prove his statement that all this was known in literature, and that he raised this claim to reject the dissertation because he didn't like it. - He couldn't defend against any of my technical objections and citations. He is not even claiming that his expertise is correct, and obviously was completely surprised by the fact that I have access to his expertise (unlike the university where he is working, where they keep the expertises secret). - When I demanded to receive reasons, he denied that and stated that he would not agree with the requirent to reason an expertise. Instead, he had based his examination on an "international consensus" that would free him from the need to give reasons. He also stated that it would be illogical to require an examiner to give reasons for his expertise, because candidates could succeed with empty dissertations then. (???) So this expertise is just ridiculous and won't have any chance at a court, except that it will take me again years for the lawsuit. I then informed the IACR's board of directors and asked them whether an organization, where such a person can become a director can be trusted any longer in context of security and cryptography. Surprisingly, they were not even surprised. The fully tolerate this and even consider this as normal. It looks as if they consider this kind of expertise as kind of self-evident. To help a colleague and protect him from legal trouble seems to be much more important than giving correct and reasonable expertises. I discussed that with several friend and colleagues, all working in security and cryptography, and they were all shocked. Everyone would have bed that they would kick everyone out known to have given a false expertise. But they don't. Very similar with the supervisor and the former second examinor: It is more than obvious that both had given intentionally wrong expertises and were claiming technical nonsense. But everyone seems to silently accept this and to consider this as normal. When preparing for the lawsuit, I read several other dissertations in order to compare them. I found several of them to be really wrong or to contain nothing but citations from literature. One of these dissertations would never have been published if I hadn't asked for a copy. It was then published around two years after the examination and contained just citations from literature. So what I found is fraud, extortion, false expertises. But not a single one of those cryptographers burns. Maybe it's a minority writing false expertises. But it's a majority accepting that. So my doubt is not so much about that someone found the magic way to factorize. It's about someone intenionally selling snake-oil or backdoors and other's keeping their mouth shut and tolerate this as they do it here. I have three expertises proven to be intentionally wrong. One from someone who is known to have no clue about security. One from someone who is known as a cryptographer and once claimed to be one of the "top four". And one from someone who is a director of IACR. And no one cares about. Nobody told me I'd be wrong. Nobody doubted my claims, objections, and technical arguments. I could easily show that all of them have intentionally given wrong expertises. Some people even explicetely confirmed that my dissertation is correct and the expertises are wrong. This just doesn't matter in any way. Isn't that spooky? What kind of business is cryptography? regards Hadmut --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: [tor-talk] Tor and HTTPS graphic
by coderman 06 Jul '18

06 Jul '18

On Mon, Mar 12, 2012 at 11:57 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > ... > Your ideas intrigue me and I wish to subscribe to your newsletter. my last comment for this sad, confused tangent of a thread; it has been accosted via conjecture with too much frequency *grin* SCTP for congestion control of transparent proxy TCP/UDP traffic. local classification of traffic allocates by protocol / use fairness instead of aggregate tcp fairness. like bittorrent or aria2 parallel traffic treated as distinct low priority unit of traffic, deferring to higher priority low latency web traffic and messaging. multi-homing / multi-path endpoints in SCTP would maintain concurrent connection with distinct endpoints, avoiding predecessor, timing, denial of service attacks present in reliable, ordered, single stream transports. edges would be screwed as you mention, unless they were full fledged participants consistently. using a UDP based transport with LEDBAT or other technique to keep broadband upstream unsaturated and unclogged (no deep queues), allowing all broadband endpoints the ability to contribute to a large shared network. ORCHID IPv6 addressing with IPsec tunnels is intended to re-use existing work, including well tested auth+privacy with datagram padding in IPsec. SCTP+TLS would fit over top of IPv6 ORCHID endpoints (using IPsec SAs) to transport signalling/keying and encapsulated client traffic. part of this would also include lowest priority (lossy reliable) SRMP type delivery of useful, less immediate information to nodes. to some extent the ORCHID addresses could be thought of as hidden service names and also circuit endpoints for a given IPsec tunnel. this set of: a. critical signalling and keying traffic b. high priority, interactive web traffic and messaging c. lower priority bulk traffic, downloads, streaming media d. best effort, latent bulk caching and exchange are the classful shaping groups ordered inside of opaque SFQ outbound queues at various improved/concurrent stratified dependent link padding paths of IPsec telescopes carrying intermediate hop(signalling) and bearer traffic. combining better prioritization of traffic and consistent consumption of traffic (deferring low priority packets and using opportunistic caching strategies for network information respectively) obtains the best performance out of the SFQ DLP paths with the lowest latency for priority traffic. still, so many details left as exercise for the reader ;) > Do free reference implementations exist for all of these protocols? sort of, for only parts; if you want a portable user space implementation (or port) it's all custom. the joys of wild conjecture include absurd timelines and technical effort for free... rump is about as close as i've seen: http://www.netbsd.org/docs/rump/index.html this is not the least of "how to deploy a thing like this" concerns. there is also no backward compatibility or slow transition from an existing Tor network to something using UDP encapsulated IPsec telescopes (even if TCP can be transparently proxied over SCTP over this). _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [Freedombox-discuss] Who's interested in project management & collaboration tools? And...
by Miles Fidelman 06 Jul '18

06 Jul '18

Jay Sulzberger wrote: > >>> >>> http://www.kickstarter.com/projects/1947703258/smart-notebooks-keeping-on-t… >>> >>> > > Perhaps just limited encrypted Usenet? Funny you should mention that. NNTP is, to my mind, the world's greatest messaging protocol. Back in the day, Netscape built a "collaboration server" that added access controls and some management functions to an NNTP server - it was an incredibly powerful tool. In some sense, the model sitting in the back of my mind, is: - NNTP (with encryption and crypto-based access controls) - easier management of (private) group creation - messages containing HTML & JavaScript that can do some embedded threading (think about sending a Wiki page, the initial page shows up as a news message, edits are automatically applied rather than showing up as separate messages) > > Also perhaps: > > http://www.kickstarter.com/projects/joeyh/git-annex-assistant-like-dropbox-… > > > with a daemon that labels files, presents histories, and such like. > > Yes... saw that a while back - does look really interesting. Miles -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

FC: House will vote on bill to regulate online campaign advertising
by Declan McCullagh 06 Jul '18

06 Jul '18

http://www.wired.com/news/politics/0,1283,45138,00.html Mulling Reins on Net Campaigns By Declan McCullagh (declan(a)wired.com) 2:00 a.m. July 11, 2001 PDT WASHINGTON -- The House of Representatives is scheduled to vote Thursday on a campaign finance bill that would, for the first time, regulate Internet advertisements and e-mails targeted at voters. The new rules aimed at online political activity are part of a Republican effort to overhaul U.S. election law that has received little scrutiny -- which, if enacted, would roil the fast-growing online campaign industry and impose obstacles on candidates' use of the Internet. Jonah Seiger, co-founder of Mindshare, a 16-person Internet consulting firm in Washington, said he understands why the legislation was written to cover "any communications" directed at voters, and not just traditional methods. "But I hope Congress would understand what they're doing," Seiger said. "The unintended consequences of sloppy legislation could make it more difficult to use the Internet and make it less effective as a political communications medium." On Thursday, the House will consider a campaign finance plan patterned after a bill backed by Sen. John McCain (R-Arizona) that the Senate has already approved. That proposal, H.R.2356, covers only political communications sent by broadcast, satellite, cable or the U.S. mail, and does not apply to the Internet. But the version that House Republicans will offer as an alternative is far broader in one important way: It regulates "any" paid communication -- including Internet communication -- that mentions a candidate for federal office. Anyone who makes such a communication, not just political parties or candidates, would be required to keep careful records and count online spending toward a $50,000 limit that would trigger a filing with the federal government. The bill's drafters say they intended to regulate the burgeoning world of Internet politics but predicted the legislation's impact would be limited. Roman Buhler, counsel to the House Administration Committee, said "when we thought about the Internet we doubted that the cost of Internet messages, such as bulk e-mails, would rise to that level.... It was our sense that bulk e-mails would not approach the $50,000 threshold." (The bill does count e-mail spending toward the $50,000 trigger point.) "A banner ad would be a form of mass communication, and they would have to disclose," Buhler said. Ken Nealy, a press secretary for bill sponsor Rep. Albert Wynn (D-Maryland), refused to speak on the record. When asked in person what effects the bill would have on the Internet, Nealy declared that the conversation was over and left the room. [...] ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe, visit http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- ----- End forwarded message -----

1 0

[wearables] Nokia cellular cameras
by Mr Ellis Weinberger 06 Jul '18

06 Jul '18

Nokia sell cameras which contain motion sensors, temperature sensors, microphones, and cell phones, and which can send sms, mms, and smtp messages: Nokia Observation Camera: http://www.nokia.com/nokia/0,,4654,00.html Nokia Remote Camera: http://www.nokia.com/nokia/0,,63911,00.html -- Mr Ellis Weinberger | West Road | t: (+44) (0)1223 333054 Research Associate | Cambridge | f: (+44) (0)1223 333160 Cambridge University Library | CB3 9DR | e: ew206(a)cam.ac.uk url: http://www.cus.cam.ac.uk/~ew206/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

The Genius and Struggle of PayPal
by Mises Daily Article 06 Jul '18

06 Jul '18

<http://www.mises.org/articles.aspx> The Genius and Struggle of PayPal by William L. Anderson <http://www.mises.org/fullstory.aspx?Id=1710>[Posted January 4, 2005] The PayPal Wars: Battles with eBay, the Media, and the Rest of Planet Earth. Eric M. Jackson, World Ahead Publishing, Los Angeles, California, 344 pages, $27.95. Almost five years have passed since the heady days of the dot.com boom, an era that began as the "New Economy" and ended in yet another recession and the collapse of stock prices that in 1999 seemed to have no upward limits. In hindsight, we can see that the "New Economy" was nothing more than the shotgun wedding of the obvious commercial possibilities of the Internet and the irresponsible, expansionary monetary policies of Alan Greenspan's Federal Reserve System, not a marvelous invention created by Bill Clinton through the magic of raising income tax rates. That the dot.com boom turned into a bust does not take away from many of the real success stories of that time, one of them being the emergence of PayPal, which helped revolutionize the way payments could be made using the Internet. The original vision that the creators of PayPal (Peter Thiel, a hedge fund manager, and Max Levchin, an engineer who originally was from the Ukraine) had in mind was a system that would permit people around the world not only to be able to pay each other via the Internet, but also to be able to protect themselves when their governments were inflating their currencies. "World Domination" was the theme of this venture, beginning in 1999, in Silicon Valley. Like so many other "high-tech" companies that bloomed in the San Francisco Bay Area during the 1990s, it had the famed "no collar" business culture that made these firms the darlings of an adoring media that later would turn against them en masse when the "New Economy" collapsed like the house of inflationary cards that it was. PayPal, unlike many of the others, like Pets.com, Webvan.com, and etoys.com, hung on, grew, and finally prospered, thanks in no small part to a refugee from the "Old Economy," Eric M. Jackson, who has authored this book. While Jackson's book is far from an exercise in megalomania (in fact, Jackson is one of the more humble authors I have read recently), he was the one who steered PayPal to its most famous moorings: the mechanism of payment choice for hundreds of thousands of people who use the on-line auction services of eBay. Before going on, let me say that The PayPal Wars is valuable not only because it gives the reader an inside view of the entrepreneurial madness that was Silicon Valley, but also because Jackson understands the larger picture of which PayPal was a part. He understands the nature of boom and bust (this despite the fact that he received an economics degree from the decidedly mainstream program of Stanford University), pointing out the role of the Federal Reserve System in this latest sorry economic episode. That alone is enough to make the book worth reading. Furthermore, Jackson understands the predatory nature of the regulatory system that nearly brought down the company after it successfully completed its initial public offering (IPO) in 2002, a feat notable in itself, given the hostile climate that developed after many of the dot.coms went bust. State and federal regulators, as clearly demonstrated in this book, contributed nothing to the quality and "safety" of the product, that being a relatively safe and secure mechanism for using the Internet to make payments. Before the regulators came the fierce competition from other companies wanting to duplicateor at least closely resemblethe PayPal system, as it should be. Such competition made PayPal more innovative and nimble, a trait that was enhanced by the innovative and nimble corporate culture that the company developed, something those interested in Austrian Economics would appreciate, given the primacy of the entrepreneur in the Austrian system. Yet, despite the challenges from competitors, the invasion of Russian organized crime rings that almost brought down the firm through fraudulent accounts, and the pack mentality of the news media, as Jackson points out, government ultimately slowed and nearly stopped the whole enterprise. The state-enforced roadblocks came through predatory regulators and politicians like Elliot Spitzer, the state attorney general of New York, who graciously took time from his shakedown of Wall Street firms to squeeze some "free" cash from PayPal. The second state-enforced barrier came from the trial lawyers acting through class action suits, a mechanism set up by government courts that enriches lawyers and ultimately impoverishes businesses and consumers. The story begins with Thiel recruiting Jackson, in November 1999, to his new firm using that "New Economy" incentive, the stock option. Jackson at that time was a young analyst locked in the bowels of the firm formerly known as Arthur Andersen. At the time, it must have seemed a foolish move, what with PayPal being an unknown startup and Andersen being one of the best-established firms in the world. (Who would have imagined that in five years hence, PayPal would be a world-wide name and Andersen eviscerated by John Ashcroft's Department of Justice on bogus criminal charges for the crime of being the unlucky firm to be handling the Enron account?) Jackson's arrival at PayPal proved to be something out of Silicon Valley stereotypes. He writes: I introduced myself to the receptionist, who had no idea that I was expected. . . . My concern grew. Three people in the company who should have known about my job offer seemed completely stumped. Could Peter (Thiel) have changed his mind? . . . I had no idea what was going on. (pp. 1718) Nor did the initial conditions he faced at Confinity (the official name of the company that gave us PayPal), where the environment was thoroughly unstructured, ease his anxiety: What have I gotten myself into? I pondered as I tested the password to my new Confinity e-mail account on a borrowed computer. I had no job description, my colleagues didn't know who I was, and there wasn't even a desk for me in the building! At least Andersen gave its new hires a place to sit. (p. 20) The company brass finally found a place for Jackson to sitin the "ping-pong room"and the young Stanford economics graduate soon found out he would be involved in marketing PayPal. The idea behind Confinity's signature product was disarmingly simple. While there were many ways for individuals to transfer money to each other, all had limitations. Wire transfers could be costly and required knowledge of both bank accounts, which is information that could easily find its way into the wrong hands. Credit cards are convenient, but few individuals have setups where they can handle the plastic, that being the purvey of businesses who deal in volume. But Thiel's inspiration was far more encompassing than just developing a convenient payment system for small merchants and traders. Jackson recalls a conversation during which Thiel explained his vision: The need PayPal answers is monumental. Everyone in the world needs moneyto get paid, to trade, to live. Paper money is an ancient technology and an inconvenient means of payment. You can run out of it. It wears out. It can get lost or stolen. In the twenty-first century, people need a form of money that's more convenient and secure, something that can be accessed from anywhere with a PDA (palm pilot) or an Internet connection. Of course, what we're calling "convenient" for American users will be revolutionary in the developing world. Many of these countries' governments play fast and loose with their currencies. . . . They use inflation and sometimes wholesale currency devaluations, like we saw in Russia and several Southeast Asian countries last year, to take wealth away from their citizens. Most of the ordinary people there never have an opportunity to open an offshore account or to get their hands on more than a few bills of a stable currency like U.S. dollars. The $64 question is this: How did this grand vision of an alternative way of holding and trading money ultimately become the mechanism of choice for traders using eBay? The credit there goes to Jackson, who while surfing the Internet came upon eBay and realized that most of the small traders and sellers using that site were limited to using the mail to transfer payments in the form of checks, since the average household is not set up to handle credit cards. It was not long before Jackson convinced his superiors to use eBay, and soon it accounted for about 70 percent of PayPal's transactions. However, there were two problems that soon followed. The first was finding a way to make the system profitable. PayPal did not charge for small users (the company did introduce transactions fees for "business" users), instead making its money through the "float" in which it was able to temporarily hold the money before the final transactions were completed. Dependence upon the "float," however, proved to be a loser and the company struggled with a mechanism that would enable it to collect fees yet not drive away its loyal customers. The second problem dealt with duplicate services. For example, eBay developed Billpoint, its own online payment mechanism, and other similar services soon popped up, most of them being backed up by large banks. Furthermore, eBay used a number of tactics in an attempt to steer its customers toward Billpoint and away from PayPal, only to find that the decentralized and nimble crew at Confinity always found a way around the private barriers. To deal with one competitor's threatcoming from X.comConfinity ultimately merged with the firm, creating a marriage that was made elsewhere than Heaven. While Confinity was loosely structured with an entrepreneurial spirit, X.com was more "top down" in structure, decision making dominated by Elon Musk, a capable but sometimes bull-headed CEO who imposed policies that seemed to come more from the comic strip "Dilbert" than the honest give-and-take of business analysis. For example, Musk was stuck on the "X" name to be given to PayPal (X-PayPal) despite its negative connotations. Writes Jackson: While compiling research to support the continued use of the PayPal name, I tracked down a videotape of several focus groups held by an X.com researcher hired the prior summer. The participants in the groups unsurprisingly disparaged the X brand. Women complained that it seemed pornographic, and middle-aged men remarked that it sounded too much like Generation X, comments similar to what we'd heard during the several focus groups held by Confinity. The tapes provided no rationale whatsoever for the use of the X brand. . . . The official write-up from the research answered the question. In almost Orwellian fashion, the summary claimed that the participants liked the X.com name and identified it with "brand X," which supposedly stood for the underdog or the sympathetic little guy. (p. 131) I include this passage not to disparage Musk but rather to point out that even in the profit-making world of business, reports sometimes are written to please the top brass, not deal with real consumer preferences. However, unlike government, where such reports are commonplace and the authors and originators of failed policies rarely must pay for telling half-truths or outright lies, Musk ultimately paid for his bad vision. He was removed from his CEO position by the company's board of directors almost immediately after he announced that X.com was going to discontinue PayPal. The commercial marketplacethat entity regularly denounced by the political classesrewards truth and punishes lying (or "spin," as politicians like to call it). The next challenge came from Russian mafiosos, who were tapping the PayPal accounts on a regular basis, creating large fraud losses. Again, the nimble corporate culture came to the rescue, as the PayPal teams found ways to circumvent the criminals without largely inconveniencing their customers. (Contrast this with the way the Transportation Security Administration largely inconveniences airline passengers to conduct what clearly are ineffectual methods to prevent terrorist hijackings. A gaggle of lawyers soon appeared to sue PayPal because some customers had trouble accessing their accounts; no one sues the TSA just like no one sued the FAA or other U.S. Government agencies after the 9/11 attacks. Only the airlines found themselves in court.) After suffering losses its first few years, PayPal finally began to show a small profit, and it was able to attract the investors who ultimately were willing to purchase its stock following the company's IPO in early 2002. Not surprisingly, the prospect of a new firm coming into the public arena drew not only media coverage, but "entrepreneurial" lawyers and government regulators. Lawyers found ways to bring class action suits while government officials like Elliot Spitzer found ways to demand payments from the company for nonexistent regulatory violations in order to gain permission to operate within their states. In the end, however, PayPal "won." That is, the idea survived and the company survived as well. However, soon after the IPO was completed, the principals decided to sell it to eBay, which quickly jettisoned its ineffective Billpoint and used PayPal as one of its payment mechanisms. Jackson and others who had thrived in the open culture of Confinity (and later X.com) found the "old economy" top-down, MBA-oriented culture of eBay too much to handle and left for other ventures. I have gone through the story, but have not commented on my opinion of this book. Is it worth reading? Absolutely. Does it have a useful and important story to tell? Yes, indeed it does. (I must admit that I liked it so much that I plan to make it required reading for my MBA students beginning in the fall of 2005.) The genius of The PayPal Wars is more than it's being an interesting business story. In the end, it is a wonderful exposition of Austrian Economics, even if that is not what the author intends. We see entrepreneurship, government regulation, and the boom-and-bust business cycles in action, presented in a manner in which the author not only sees the immediate "small" picture, but the larger picture at the same time. It definitely is worth taking the time to read, and those who do will better understand those madcap days in which people mistakenly believed that the laws of economics had been overthrown forever. _______________________ William Anderson, an adjunct scholar of the Mises Institute, teaches economics at Frostburg State University. Send him <mailto:banderson@mail.frostburg.edu>MAIL. See his Mises.org <http://www.mises.org/articles.asp?mode=a&author=Anderson>Articles Archive. Comment on the <http://www.mises.org/blog>blog. In response to many requests, it is now possible to set your credit-card contribution to the Mises Institute to be recurring. You can easily set this up on-line with a donation starting at $10 per month. See the <https://www.mises.org/donate.asp>Membership Page. This is one way to ensure that your support for the Mises Institute is ongoing. <http://www.mises.org/fullstory.aspx?Id=1710>[Print Friendly Page] <http://www.mises.org/blog/> <http://www.mises.org/elist.asp>Mises Email List Services <https://www.mises.org/donate.asp>Join the Mises Institute <http://www.mises.org/store>Mises.org Store <http://www.mises.org/>Home | <http://www.mises.org/about.asp>About | <http://www.mises.org/elist.asp>Email List | <http://www.google.com/u/Mises>Search | <http://www.mises.org/contact.asp>Contact Us | <http://www.mises.org/journals.asp>Periodicals | <http://www.mises.org/articles.asp>Articles | <http://www.mises.org/fun.asp>Games & Fun <http://www.mises.org/fun.asp>FAQ | <http://www.mises.org/StudyGuideDisplay.asp?SubjID=117>EBooks | <http://www.mises.org/scholar.asp>Resources | <http://www.mises.org/catalog.asp>Catalog | <https://www.mises.org/donate.asp>Contributions | <http://www.mises.org/calendar.asp>Freedom Calendar You are subscribed as: rah(a)ibuc.com Manage <http://mises.biglist.com/list/article/?p=prefs&pre=l&e=13958347&pw=1tyvx5to…>your account. Unsubscribe <http://mises.biglist.com/list/article/?p=unsub&pre=l&e=13958347&pw=1tyvx5to…>here or send email to <mailto:article-unsub-13958347@mises.biglist.com>this address. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[liberationtech] Security experts have no details on Iranbs claim it was targeted by new malware
by Cyrus Farivar 06 Jul '18

06 Jul '18

http://internetofelsewhere.com/blog/2011/04/26/security-experts-have-no-det… On Monday, Gholam Reza Jalali, the commander of the Iranian civil defense organisation, stated on his organizationbs website that Iran had been hit by a new cyberworm, a la Stuxnet, called b Stars.b b The Stars virus has been presented to the laboratory but is still being investigated,b Jalali said, according to a translation by the Washington Post. Jalali announced earlier this month that Iran would be launching new graduate degree programs in cybersecurity as a way to counter the effects of the Stuxnet worm. But, in the Monday post, Jalali added that the new virus is tough to eradicate, as it can be b mistaken for executive files of governmental organizations.b But the thing is, no one b apparently outside of Jalali and his colleagues b have actually seen any technical evidence of this new malware. b We have no further information on this attack at this time,b wrote Mikko Hypponen, a computer security researcher with F-Secure, on his companybs blog. b We canbt tie this case to any particular sample we might already have. We donbt know if this is another cyber attack launched by US Government. We donbt know if Iran officials have just found some ordinary Windows worm and announced it to be a cyber war attack. Hopefully webll find out more soon.b On its blog, McAfee, anotheer computer security firm, echoed this sentiment: b Outside of the published news reports, McAfee has no information on bStarsb at this time,b wrote Joris Evers, a company spokesperson. b Thatbs different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples. We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.b On Tuesday, Graham Cluley, a researcher at Sophos, posted on Twitter said: b Webd need to see the malware first. And the Iranian reports are far too vague to work out if itbs something we already know about.b He added later: b Itbs my *guess* that it exists. A hunch if you prefer. But precisely what it is remains unclear.b Reached by e-mail, a representative from Kaspersky Labs wrote: b At the moment, Kaspersky Lab experts donbt have any information to share.b -- Cyrus Farivar "suh-ROOS FAR-ih-var" Freelance technology journalist and radio producer Author, "The Internet of Elsewhere" http://www.internetofelsewhere.com DE: +49 163 763 3108 (m) US: +1 510 394 5485 (m) Twitter/Skype: cfarivar "Being a good writer is 3% talent, 97% not being distracted by the Internet." http://cyrusfarivar.com cfarivar(a)cfarivar.org _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[liberationtech] Security experts have no details on Iranbs claim it was targeted by new malware
by Cyrus Farivar 06 Jul '18

06 Jul '18

http://internetofelsewhere.com/blog/2011/04/26/security-experts-have-no-det… On Monday, Gholam Reza Jalali, the commander of the Iranian civil defense organisation, stated on his organizationbs website that Iran had been hit by a new cyberworm, a la Stuxnet, called b Stars.b b The Stars virus has been presented to the laboratory but is still being investigated,b Jalali said, according to a translation by the Washington Post. Jalali announced earlier this month that Iran would be launching new graduate degree programs in cybersecurity as a way to counter the effects of the Stuxnet worm. But, in the Monday post, Jalali added that the new virus is tough to eradicate, as it can be b mistaken for executive files of governmental organizations.b But the thing is, no one b apparently outside of Jalali and his colleagues b have actually seen any technical evidence of this new malware. b We have no further information on this attack at this time,b wrote Mikko Hypponen, a computer security researcher with F-Secure, on his companybs blog. b We canbt tie this case to any particular sample we might already have. We donbt know if this is another cyber attack launched by US Government. We donbt know if Iran officials have just found some ordinary Windows worm and announced it to be a cyber war attack. Hopefully webll find out more soon.b On its blog, McAfee, anotheer computer security firm, echoed this sentiment: b Outside of the published news reports, McAfee has no information on bStarsb at this time,b wrote Joris Evers, a company spokesperson. b Thatbs different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples. We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.b On Tuesday, Graham Cluley, a researcher at Sophos, posted on Twitter said: b Webd need to see the malware first. And the Iranian reports are far too vague to work out if itbs something we already know about.b He added later: b Itbs my *guess* that it exists. A hunch if you prefer. But precisely what it is remains unclear.b Reached by e-mail, a representative from Kaspersky Labs wrote: b At the moment, Kaspersky Lab experts donbt have any information to share.b -- Cyrus Farivar "suh-ROOS FAR-ih-var" Freelance technology journalist and radio producer Author, "The Internet of Elsewhere" http://www.internetofelsewhere.com DE: +49 163 763 3108 (m) US: +1 510 394 5485 (m) Twitter/Skype: cfarivar "Being a good writer is 3% talent, 97% not being distracted by the Internet." http://cyrusfarivar.com cfarivar(a)cfarivar.org _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [p2p-hackers] Distributed filesystem choices (aka: none yet?)
by James A. Donald 06 Jul '18

06 Jul '18

On 2012-03-23 4:55 AM, Volodya wrote: > I don't quite understand. The system must be [anonymous in the sense that the > uploader cannot be identified]&& [have moderation system based on something > other than the blocks popularity like in GnuNet/Freenet*]. The system must be > [using limited amount of disk space given by its users] and [provide infinite > storage guarantee when moderation doesn't apply]. > > I think that the reason why you can't find this filesystem is akin to the reason > why all-powerful, all-knowing, and all-good god has not been spotted yet. Here is a solution: Everyone is, as with Bitcoin, identified by a public key - but by quite a few public keys, providing not anonymity but pseudonymity. When you store stuff on someone else's system you issue an IOU, which IOU is anonymously transferable, using a chaumian protocol, which *does* provide anonymity - you pseudonymously store other people's stuff, and anonymously use the resulting IOUs to store your own stuff. >From time to time you check that stuff that is stored on someone else's system is available by random sampling. When stuff stored on someone else's system becomes inaccessible, you note him as unreliable, and thus decline to issue IOUs or services to him in future, though since IOUs are transferable, you are still up for any IOUs you have issued to him in the past. The software attempts to cancel out IOUs - so that if Bob provides services to Carol, Carol provides services to Edwards, and Edwards provides services to Bob, they cancel out. If someone's IOUs get cancelled out in a cycle of IOUs that include your own, or include those you have confidence are reliable, this is evidence he is reliable in that his IOUs are good. You try to store stuff with those that you have reason to believe are reliable, and with those where storing stuff with them enables you to cancel out IOUs. You give low priority to storing stuff from people whose IOUs you have no reason to believe. Repeating: You pseudonymously store other people's stuff, using a nym that gains reputation thereby, and anonymously store your stuff on other people's systems, using a nym with no reputation. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0