October 2013 - cypherpunks - lists.cpunks.org

Secrecy News -- 10/08/13
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Steven Aftergood <saftergood(a)fas.org> ----- Date: Tue, 08 Oct 2013 08:59:10 -0700 From: Steven Aftergood <saftergood(a)fas.org> To: eugen(a)leitl.org Subject: Secrecy News -- 10/08/13 Message-ID: <181be29e41961c44cc8cf25aaf148cf5(a)lists.fas.org> Reply-To: saftergood(a)fas.org X-Mailer-LID: 1 X-Mailer-RecptId: 399049 X-Mailer-SID: 1881 X-Mailer-Sent-By: 2 Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2013, Issue No. 87 October 8, 2013 Secrecy News Blog: http://blogs.fas.org/secrecy/ ** CIA HALTS PUBLIC ACCESS TO OPEN SOURCE SERVICE CIA HALTS PUBLIC ACCESS TO OPEN SOURCE SERVICE For more than half a century, the public has been able to access a wealth of information collected by U.S. intelligence from unclassified, open sources around the world. At the end of this year, the Central Intelligence Agency will terminate that access. The U.S. intelligence community's Open Source Center (OSC), which is managed by the CIA, will cease to provide its information feed to the publicly accessible World News Connection as of December 31, 2013, according to an announcement from the National Technical Information Service (NTIS), which operates the World News Connection (WNC). The WNC "is an online news service, only accessible via the World Wide Web, that offers an extensive array of translated and English-language news and information," an NTIS brochure explains. "Particularly effective in its coverage of local media sources, WNC provides you with the power to identify what really is happening in a specific country or region. Compiled from thousands of non-U.S. media sources, the information in WNC covers significant socioeconomic, political, scientific, technical, and environmental issues and events." "The information is obtained from full text and summaries of newspaper articles, conference proceedings, television and radio broadcasts, periodicals, and non-classified technical reports. New information is entered into WNC every government business day. Generally, new information is available within 48-72 hours from the time of original publication or broadcast." "For over 60 years, analysts from OSC's domestic and overseas bureaus have monitored timely and pertinent open-source materials, including grey literature. Uniquely, WNC allows you to take advantage of the intelligence gathering experience of OSC," the NTIS brochure says. Soon, that will no longer be true. http://www.ntis.gov/products/wnc.aspx The WNC public feed from the Open Source Center is a highly attenuated version of what is available to official government users. Within government, copyright considerations are ignored, but for public distribution they must be respected, and so (with some exceptions) only information products whose creators have signed a royalty agreement with NTIS are publicly released. Even with that significant limitation and the attendant public subscription fees, the NTIS World News Connection has remained a highly prized resource for news reporters, foreign policy analysts, students and interested members of the public. I check it almost every day. Recently, for example, I have been following official statements from Russian officials who allege that the U.S. is covertly developing biological weapons for use against Russia in a military laboratory in the Republic of Georgia. The claim seems bizarre, but may nevertheless be politically significant. Detailed English-language coverage of the matter, or of many other stories of regional interest and importance, is not readily available elsewhere. (Moreso than in the past, however, portions of the material that is publicly accessible through WNC can be obtained elsewhere, through other news services or foreign websites.) The reasons for the decision to terminate the World News Connection are a bit obscure. Producing it is not a drain on U.S. intelligence-- the marginal costs of providing the additional feed to NTIS are close to zero. (The total budget for open source intelligence was about $384 million in FY2012, according to classified budget records obtained by the Washington Post from Edward Snowden.) However, the program is a headache for NTIS to manage, particularly since NTIS officials had to negotiate numerous contracts with media source providers to offer their products to the public. But the large majority of that work has already been accomplished, and now it will be rendered useless. Mary Webster of the Open Source Center had initially proposed to cancel the public information feed as of September 30, according to an NTIS official. Then she was persuaded to grant a six month reprieve. But in the end, a cut-off date of December 31, 2013 was set. If that comes to pass, it will be a blow to researchers and proponents of public intelligence. The Federation of American Scientists had previously argued that the U.S. government should actually expand public access to open source intelligence by publishing all unclassified, uncopyrighted Open Source Center products. ("Open Up Open Source Intelligence," Secrecy News, August 24, 2011.) Instead, even the current range of publications will no longer be systematically released. (Only a small fraction of publicly unreleased OSC records ever seem to leak.) http://blogs.fas.org/secrecy/2011/08/open_up_osint/ Although the Open Source Center is managed by the Central Intelligence Agency, it is formally a component of the Office of the Director of National Intelligence. Yet the move the terminate public access to OSC products seemed to catch the ODNI unawares. "Obviously our attention is on a possible lapse in appropriations, but we are looking into this," said an ODNI spokesman on September 30, just before the government shutdown. "The information provided through NTIS makes an irreplaceable contribution to U.S. national security," wrote Prof. Gary G. Sick of Columbia University in an October 1999 letter, in response to a previous proposal to curtail coverage in the World News Connection. The World News Connection "informs us about other countries in ways that otherwise would be nearly impossible," Dr. Sick wrote. "It costs virtually nothing in comparison with almost any other national security system. It is not as sexy as a bomber or a missile, but its contributions to national security can be attested to by generations of policy-makers. I was in the White House during the Iranian revolution and the hostage crisis, and my respect for the power of this information was born at that time. I often found it more helpful than the reams of classified material that came across my desk at the NSC." http://www.fas.org/irp/fbis/sicklet.html _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://blogs.fas.org/secrecy/subscribe/ To UNSUBSCRIBE, go to http://blogs.fas.org/secrecy/unsubscribe/ OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: https://members.fas.org/donate _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] Tor Weekly News — October 9th, 2013
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Joe Btfsplk <joebtfsplk(a)gmx.com> ----- Date: Wed, 09 Oct 2013 12:41:04 -0500 From: Joe Btfsplk <joebtfsplk(a)gmx.com> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Tor Weekly News — October 9th, 2013 Message-ID: <52559530.1060502(a)gmx.com> User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 Reply-To: tor-talk(a)lists.torproject.org On 10/9/2013 10:27 AM, Lunar wrote: > ======================================================================== > Tor Weekly News October 9th, 2013 > ======================================================================== > > Welcome to the fifteenth issue of Tor Weekly News, the weekly newsletter > that covers what's happening in the world of Tor — “king of high-secure, > low-latency anonymity” [1]. > > [1] http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… > > New tranche of NSA/GCHQ Tor documents released > ---------------------------------------------- > > ... a series of stories were published > in the Guardian and the Washington Post that detailed alleged attempts > by NSA, GCHQ, and their allies to defeat or circumvent the protection > that Tor offers its users. ... > > The documents in question [3] offer,... a summary of > attacks against Tor users and the network as a whole that they have > considered or carried out. > I'm sure Tor developers have considered the real possibility that some or all of what different agencies release, about their capabilities & successes (or lack of) against Tor - or anything else, is misinformation, designed to make the Tor Project AND users more comfortable in continuing to use TBB. Logically, if any agency or adversary divulged they can somewhat successfully track users or "infiltrate the system," then most would stop using it and a valuable method to gather information or catch "criminals" would cease to exist. Good poker players and gov'ts NEVER reveal their hands. I wouldn't take seriously anything that ANY gov't publicly reveals about their technology or intelligence capability (or lack there or). Over a long history, it's been repeatedly shown that advanced gov'ts always know more & have more technology capability, than is revealed. That is, often until decades later, when the real truth comes out. It's no different now. -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] The Unintended Consequences of Internet Diffusion: Evidence from Malaysia - CDDRL
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Yosem Companys <companys(a)stanford.edu> ----- Date: Wed, 09 Oct 2013 10:01:52 -0700 (PDT) From: Yosem Companys <companys(a)stanford.edu> To: Liberation Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] The Unintended Consequences of Internet Diffusion: Evidence from Malaysia - CDDRL Message-ID: <20130929032139.14625.98397@domU-12-31-39-0A-A0-4F> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> http://cddrl.stanford.edu/events/7900 The Unintended Consequences of Internet Diffusion: Evidence from Malaysia Program on Liberation Technology Seminar Series DATE AND TIME October 10, 2013 4:30 PM - 6:00 PM AVAILABILITY Open to the public No RSVP required SPEAKER Luke Miner - Data Scientist at Stanford University Abstract: Can the introduction of the Internet undermine incumbent power in a semi-authoritarian regime? I examine this question using evidence from Malaysia, where the incumbent coalition lost its 40-year monopoly on power in 2008. I develop a novel methodology for measuring Internet penetration, matching IP addresses with physical locations, and apply it to the 2004 to 2008 period in Malaysia. Using distance to the backbone to instrument for endogenous Internet penetration, I find that areas with higher Internet penetration experience higher voter turnout and higher candidate turnover, with the Internet accounting for one-third of the 11% swing against the incumbent party in 2008. The results suggest that, in the absence of the Internet, the opposition would not have achieved its historic upset in the 2008 elections. Luke Miner is a recent Ph.D. in Economics from the London School of Economics. He was also a postdoctoral fellowship at the Center on Democracy, Development and the Rule of Law (CDDRL) in the Liberation Technology program. He is currently working as a data scientist in the tech sector. Miner’s research interests are political economy and development economics. In particular, he aims to quantitatively assess the effect of the Internet and new media on political accountability, development, and election outcomes. His past research finds a strong effect of Internet diffusion on results of Malaysia's 2008 elections, where it contributed to the ruling coalition's largest electoral setback in thirty years. His current research looks at the effect of the Internet on the 2008 US presidential elections, in particular as a means of promoting campaign contributions. LOCATION Wallenberg Theater Wallenberg Hall 450 Serra Mall, Building 160 Stanford, Ca 94305-2055 -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others?
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Jim Thompson <jim(a)netgate.com> ----- Date: Wed, 9 Oct 2013 18:38:50 +0200 From: Jim Thompson <jim(a)netgate.com> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others? Message-Id: <CA528C57-0280-4175-B2D0-C5A92C79976D(a)netgate.com> X-Mailer: Apple Mail (2.1812) Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> Exactly, although this rule doesn’t just apply to “small companies”. Big companies have shown to just roll over and give up the customer’s data. So asking the question is stupid(*), because a lie is indistinguishable from the truth. No, the NSA hasn’t approached us about pfSense, or adding a “back door”, or anything similar. Nor has anyone else. The next step is yours. I am told that the NSA did review a version of pfSense that was made for a customer which would filter SCADA protocols. I can’t verify that or not. Note also that someone DID once accuse OpenBSD of having a problem with it’s IPSEC processing, which Theo *vehemently* denied. http://www.informationweek.com/security/vulnerabilities/openbsd-founder-bel… http://marc.info/?l=openbsd-tech&m=129236621626462&w=2 Sam Leffler, about four years earlier, found a bug in the AH processing, which he fixed (in FreeBSD) and handed back to the OpenBSD. They patched same, but never gave any acknowledgement to Sam. So, maybe you should run OpenBSD. Jim * as it turns our, yes, Samantha, there is a Santa Clause^W^W^W^Ware stupid questions. On Oct 9, 2013, at 6:22 PM, Walter Parker <walterp(a)gmail.com> wrote: > The big problem with asking the question "Has the NSA required you to add a back door?" is that no small company that wants to say in business can or will say yes (If they do, no one will trust/use the product unless forced themselves). The company will agree/be forced to say no. How does one tell that no from an authentic no? > > Therefore, once trust is question, the only way to be sure is to do the self review suggested earlier... > > However, from my perspective, the code in pfSense is more like to be secure than any commercial, closed source solution. See prior threads about FreeBSD security. > > > Walter > > > On Wed, Oct 9, 2013 at 9:10 AM, Thinker Rix <thinkerix(a)rocketmail.com> wrote: > On 2013-10-09 19:03, Jim Thompson wrote: > (TIC mode: on) > Sorry, but I guess the whole matter - not only concerning pfSense, but the current threat to our civilization by our criminal governments as a whole - is much too serious for any "TIC-modes".. > > _______________________________________________ > List mailing list > List(a)lists.pfsense.org > http://lists.pfsense.org/mailman/listinfo/list > > > > -- > The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis > _______________________________________________ > List mailing list > List(a)lists.pfsense.org > http://lists.pfsense.org/mailman/listinfo/list _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others?
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Jim Pingle <lists(a)pingle.org> ----- Date: Wed, 09 Oct 2013 11:59:51 -0400 From: Jim Pingle <lists(a)pingle.org> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others? Message-ID: <52557D77.6000504(a)pingle.org> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> On 10/9/2013 11:20 AM, Paul Kunicki wrote: > I think that in light of the recent news of the NSA coercing various > organizations to provide them with means to eavesdrop this message has > merit and deserves response although I doubt the NSA really needs > cooperation from these guys. Does anyone else care to comment ? As far as I'm aware, nobody has contacted us, but if they did I may not know. They aren't really interested in end-user firewalls, they want infrastructure routers. We had a discussion on this already a month ago. http://lists.pfsense.org/pipermail/list/2013-September/004543.html Our code is all open source. In addition to our own code, code is also pulled from places such as FreeBSD, OpenSSL, and so on. So while our code is clean, it might be possible that if something we depend on has a flaw (perhaps by design in an encryption algorithm...) then it might be carried over. Nothing intentional on our part, and if such a thing is discovered and the offending code is fixed, we'd pull it in ASAP. So it would be more interesting to focus on FreeBSD, OpenSSL, OpenVPN, racoon, and other similar projects upon which we depend. Jim _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-talk] Tor Weekly News — October 9th, 2013
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Lunar <lunar(a)torproject.org> ----- Date: Wed, 9 Oct 2013 17:27:02 +0200 From: Lunar <lunar(a)torproject.org> To: tor-news(a)lists.torproject.org, tor-talk(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — October 9th, 2013 Message-ID: <20131009152702.GA17748@loar> User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News October 9th, 2013 ======================================================================== Welcome to the fifteenth issue of Tor Weekly News, the weekly newsletter that covers what's happening in the world of Tor — “king of high-secure, low-latency anonymity” [1]. [1] http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… New tranche of NSA/GCHQ Tor documents released ---------------------------------------------- After a cameo appearance in previous leaked intelligence documents [2], Tor found itself at the center of attention in the latest installment of the ongoing Snowden disclosures after a series of stories were published in the Guardian and the Washington Post that detailed alleged attempts by NSA, GCHQ, and their allies to defeat or circumvent the protection that Tor offers its users. A number of source materials, redacted by the newspapers, were published to accompany the articles. The documents in question [3] offer, alongside characteristically entertaining illustrations [4], an overview of the Tor network from the point of view of the intelligence agencies, as well as a summary of attacks against Tor users and the network as a whole that they have considered or carried out. Despite the understandable concern provoked among users by these disclosures, Tor developers themselves were encouraged by the often relatively basic or out-of-date nature of the attacks described. In response to one journalist's request for comment, Roger Dingledine wrote that “we still have a lot of work to do to make Tor both safe and usable, but we don't have any new work based on these slides” [5]. Have a look at the documents yourself, and feel free to raise any questions with the community on the mailing lists or IRC channels. [2] https://blog.torproject.org/blog/tor-nsa-gchq-and-quick-ant-speculation [3] http://media.encrypted.cc/files/nsa [4] https://twitter.com/EFF/status/386291345301581825 [5] https://blog.torproject.org/blog/yes-we-know-about-guardian-article#comment… tor 0.2.5.1-alpha is out ------------------------ Roger Dingledine announced [6] the first alpha release in the tor 0.2.5.x series, which among many other improvements introduces experimental support for syscall sandboxing on Linux, as well as statistics reporting for pluggable transports usage on compatible bridges. Roger warned that “this is the first alpha release in a new series, so expect there to be bugs. Users who would rather test out a more stable branch should stay with 0.2.4.x for now.” 0.2.5.1-alpha will not immediately appear on the main download pages, in order to avoid having too many versions listed at once. Please feel free to test the new release [7], and report any bugs you find! [6] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [7] https://www.torproject.org/dist/ How did Tor achieve reproducible builds? ---------------------------------------- At the end of June, Mike Perry announced [8] the first release of the Tor Browser Bundle 3.0 alpha series, featuring release binaries “exactly reproducible from the source code by anyone”. In a subsequent blog post [9] published in August, he explained why it mattered. Mike has just published the promised follow-up piece [10] describing how this feat was achieved in the new Tor Browser Bundle build process. He explains how Gitian [11] is used to create a reproducible build environment, the tools used to produce cross-platform binaries for Windows and OS X from a Linux environment, and several issues that prevented the builds from being entirely deterministic. The latter range from timestamps to file ordering differences when looking up a directory, with an added 3 bytes of pure mystery. There is more work to be done to “prevent the adversary from compromising the (substantially weaker) Ubuntu build and packaging processes” currently used for the toolchain. Mike also wrote about making the build of the compiler and toolchain part of the build process, cross-compilation between multiple architectures, and the work being done by Linux distributions to produce deterministic builds from their packages. If you are interested in helping, or working on your own software project, there is a lot to be learned by reading the blog post in full. [8] https://blog.torproject.org/blog/tor-browser-bundle-30alpha2-released [9] https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and… [10] https://blog.torproject.org/blog/deterministic-builds-part-two-technical-de… [11] http://gitian.org/howto.html Toward a new Tor Instant Messaging Bundle ----------------------------------------- A first meeting last week kicked-off the “Attentive Otter project” [12] which aims to come up with a new bundle for instant messaging. The first meeting mainly consisted in trying to enumerate the various options. In the end, people volunteered to research three different implementation ideas. Thijs Alkemade and Jurre van Bergen explored the possibilty of using Pidgin/libpurple [13] as the core component. Jurre also prepared an analysis of xmpp-client [14], together with David Goulet, Nick Mathewson, Arlo Breault, and George Kadianakis. As a third option, Mike Perry took a closer look at Instantbird/Thunderbird [15] with Sukhbir Singh. All the options have their pros and cons, and they will probably be discussed on the tor-dev mailing list and at the next “Attentive Otter” meeting. [12] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Otter/Attentive [13] https://lists.torproject.org/pipermail/tor-dev/2013-October/005544.html [14] https://lists.torproject.org/pipermail/tor-dev/2013-October/005546.html [15] https://lists.torproject.org/pipermail/tor-dev/2013-October/005555.html More monthly status reports for September 2013 ---------------------------------------------- The wave of regular monthly reports from Tor project members continued this week with submissions from George Kadianakis [16], Lunar [17], Sathyanarayanan Gunasekaran [18], Ximin Luo [19], Matt Pagan [20], Pearl Crescent [21], Colin C. [22], Arlo Breault [23], Karsten Loesing [24], Jason Tsai [25], the Tor help desk [26], Sukhbir Singh [27], Nick Mathewson [28], Mike Perry [29], Andrew Lewman [30], Aaron G [31], and the Tails folks [32]. [16] https://lists.torproject.org/pipermail/tor-reports/2013-October/000346.html [17] https://lists.torproject.org/pipermail/tor-reports/2013-October/000347.html [18] https://lists.torproject.org/pipermail/tor-reports/2013-October/000348.html [19] https://lists.torproject.org/pipermail/tor-reports/2013-October/000349.html [20] https://lists.torproject.org/pipermail/tor-reports/2013-October/000350.html [21] https://lists.torproject.org/pipermail/tor-reports/2013-October/000351.html [22] https://lists.torproject.org/pipermail/tor-reports/2013-October/000352.html [23] https://lists.torproject.org/pipermail/tor-reports/2013-October/000353.html [24] https://lists.torproject.org/pipermail/tor-reports/2013-October/000354.html [25] https://lists.torproject.org/pipermail/tor-reports/2013-October/000355.html [26] https://lists.torproject.org/pipermail/tor-reports/2013-October/000356.html [27] https://lists.torproject.org/pipermail/tor-reports/2013-October/000357.html [28] https://lists.torproject.org/pipermail/tor-reports/2013-October/000358.html [29] https://lists.torproject.org/pipermail/tor-reports/2013-October/000359.html [30] https://lists.torproject.org/pipermail/tor-reports/2013-October/000360.html [31] https://lists.torproject.org/pipermail/tor-reports/2013-October/000361.html [32] https://lists.torproject.org/pipermail/tor-reports/2013-October/000362.html Tor Help Desk Roundup --------------------- A number of users wanted to know if Tor was still safe to use given the recent news that Tor users have been targeted by the NSA. We directed these users to the Tor Project's official statement on the subject [33]. One of the most popular questions the help desk receives continues to be whether or not Tor is available on iOS devices. Currently there is no officially supported solution, although more than one project has been presented [34, 35]. The United Kingdom is now one of the countries where citizens request assistance circumventing a national firewall [36]. [33] https://blog.torproject.org/blog/yes-we-know-about-guardian-article [34] https://lists.torproject.org/pipermail/tor-dev/2013-October/005542.html [35] https://trac.torproject.org/projects/tor/ticket/8933 [36] https://lists.torproject.org/pipermail/tor-talk/2013-July/029054.html Miscellaneous news ------------------ Thanks to Grozdan [37], Simon Gattner from Netzkonstrukt Berlin [38], Wollomatic [39], and Haskell [40] for setting up new mirrors of the Tor project website. [37] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000366.ht… [38] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000370.ht… [39] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000374.html [40] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000375.html Arlo Breault sent out a request for comments on a possible new version of the check.torproject.org page [41]. [41] https://lists.torproject.org/pipermail/tor-talk/2013-October/030253.html Runa Sandvik announced [42] that the Tor Stack Exchange page has moved from private beta to public beta. If you'd like to help answer Tor-related questions (or ask them), get involved now! [43] [42] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [43] http://tor.stackexchange.com/ Philipp Winter sent out a call for testing (and installation instructions) for the ScrambleSuit pluggable transports protocol [44]. [44] https://lists.torproject.org/pipermail/tor-talk/2013-October/030252.html Not strictly Tor-related, but Mike Perry started an interesting discussion [45] about the “web of trust” system, as found in OpenPGP. The discussion was also held on the MonkeySphere mailing list, which prompted Daniel Kahn Gilmor to reply with many clarifications regarding the various properties and processes of the current implementation. To sum it up, Ximin Luo started [46] a new documentation project [47] “to describe and explain security issues relating to identity, in (hopefully) simple and non-implementation-specific language”. [45] https://lists.torproject.org/pipermail/tor-talk/2013-September/030235.html [46] https://lists.riseup.net/www/arc/monkeysphere/2013-10/msg00000.html [47] https://github.com/infinity0/idsec/ The listmaster role has been better defined [48] and is now performed by a team consisting of Andrew Lewman, Damian Johnson, and Karsten Loesing. Thanks to them! [48] https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure… Roger Dingledine released an official statement on the Tor project blog [49] regarding the takedown of the Silk Road hidden service and the arrest of its alleged operator. [49] https://blog.torproject.org/blog/tor-and-silk-road-takedown Fabio Pietrosanti asked [50] for reviews of “experimental Tor performance tuning for a Tor2web node.” Feel free to have a look [51] and provide feedback. [50] https://lists.torproject.org/pipermail/tor-talk/2013-October/030405.html [51] https://github.com/globaleaks/Tor2web-3.0/wiki/Performance-tuning Claudiu-Vlad Ursache announced [52] the initial release of CPAProxy [53], “a thin Objective-C wrapper around Tor”. This is the first component of a project to “release a free open-source browser on the App Store that uses this wrapper and Tor to anonymize requests.” Claudiu-Vlad left several questions open, and solicited opinions on the larger goal. [52] https://lists.torproject.org/pipermail/tor-dev/2013-October/005545.html [53] https://github.com/ursachec/CPAProxy Upcoming events --------------- Oct 09-10 | Andrew speaking at Secure Poland 2013 | Warszawa, Poland | http://www.secure.edu.pl/ | Oct 11 | Kelley @ Journalist Training Event | Helsiniki, Finland | http://www.journalistiliitto.fi/jp13/ | Nov 04-05 | 20th ACM Conference on Computer and Communications Security | Berlin, Germany | http://www.sigsac.org/ccs/CCS2013/ This issue of Tor Weekly News has been assembled by Lunar, harmony, dope457 and Matt Pagan. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [54], write down your name and subscribe to the team mailing list [55] if you want to get involved! [54] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [55] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[cryptome] snaps
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from taxakis <taxakis(a)gmail.com> ----- Date: Wed, 9 Oct 2013 15:42:26 +0200 From: taxakis <taxakis(a)gmail.com> To: cryptome(a)freelists.org Subject: [cryptome] snaps Message-ID: <019601cec4f5$64723140$2d5693c0$@com> X-Mailer: Microsoft Office Outlook 12.0 Reply-To: cryptome(a)freelists.org The NSA's New Risk Analysis (Bruce Schneier): https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html EFF Submits Comments to 'Independent' Office of the Director of National Intelligence's Review Group: https://www.eff.org/deeplinks/2013/10/eff-submits-comments-independent-offic e-director-national-intellgences-review David Cameron endorses MI5 chief's condemnation of Snowden leaks: http://www.theguardian.com/uk-news/2013/oct/09/david-cameron-mi5-chief-edwar d-snowden-gchq-leaks UK Police Orders Registrars to Suspend Domains of Major Torrent Sites: http://torrentfreak.com/uk-police-orders-registrars-to-suspend-domains-of-ma jor-torrent-sites-131009/ Did The NSA Help With The Silk Road Investigation? http://www.forbes.com/fdc/welcome_mjx.shtml Fact: the NSA gets negligible intel from Americans' metadata. So end collection: http://www.theguardian.com/commentisfree/2013/oct/08/nsa-bulk-metadata-surve illance-intelligence ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[cryptome] snaps
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from taxakis <taxakis(a)gmail.com> ----- Date: Wed, 9 Oct 2013 15:31:24 +0200 From: taxakis <taxakis(a)gmail.com> To: cryptome(a)freelists.org Subject: [cryptome] snaps Message-ID: <019501cec4f3$da288a30$8e799e90$@com> X-Mailer: Microsoft Office Outlook 12.0 Reply-To: cryptome(a)freelists.org Backdoors revisited by Ed Felten: https://freedom-to-tinker.com/blog/felten/the-linux-backdoor-attempt-of-2003 / with a referral to: https://lwn.net/Articles/57135/ Blackhole malware exploit kit suspect arrested: http://www.bbc.co.uk/news/technology-24456988 How Lavabit Melted Down: http://www.newyorker.com/online/blogs/elements/2013/10/how-lavabit-edward-sn owden-email-service-melted-down.html ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: NSA UTAH data center
by John Young 09 Oct '13

09 Oct '13

The NSA Data Center is bit more complicated than the usual commercial hotel or center, and perhaps is unprecedented, thus haunted by errata. It is composed of two apparently identical facilities, mirror images of one another, connected by an administrative block. Each facility has a data unit, a pair of 16-generator units, a bank of cooling towers, fuel tanks and appurtances. There is a single conventional electrical sub-station for the complex. It is it not known if both facilities were affected or only one of them. Nor is not known whether the power surges came from the conventional electrical power system or the generators, or from testing the emergency shutdown of the conventional and the kick-in of the back-up gen sets. Perhaps both powered up briefly simultaneously, overloaded surge protectors failed, excessive juice blasted the cables, panels, processors. The relatively small dollar amounts indicate that only some parts were affected. An odd feature is the banana shape, with non-parallel units, whether for aesthetics or to avoid some unknown richochet of parallelism so common in DoD and most other facilities. Imagine that the lack of parallelism, surely due to the conceit of crazed design architects eager to be different from insanely rational engineers, caused bizarre effects, or the engineers fought back with the customary make-work sabotage. This theory is most pleasing to this nuthouse designer. It fits the welter of new USG facilities worldwide which appear to have been designed by and for the bureaucratcially insane, aptly, expense not even considered, exemplary bloat essential, security bollixed to the max, national debt boosting cost over-runs and late completion obligatory for congressional inspection junkets, followed quickly by applaudable manifold jobs making repair of faults, corrections of errant design, IG investigations squelched and bigger appropriations next time. For evidence peruse the the bloated list of USG and commercial work by the data center architects, KlingStubbins. This is USACE and GSA heaven-sent pork unbridled by modesty of pre-911 war-winding-down pecuniousness. http://www.klingstubbins.com/clientlist/clientlist_alphabetical.html Then see the twisted edifice psycholpathology spread: the mirror-funhouse new headquarters for Canadian Communications Security Establishment in which the architects have been Boozed-Allened to barbarize disorienting havoc in concert with the agency's mission to cackle and banshee at the humongous wastage: http://www.hdrinc.com/portfolio/communications-security-establishment-canad… This is what has come from the massively copulating Internet, data, metadata, teradata, supercalifornication data. Imaginary only to be sure, processors idled, generators asleep, power errantly dribbling like release of Snowden's imaginary booze distillery.

2 1

NSA UTAH data center
by brian carroll 09 Oct '13

09 Oct '13

Power surges 'cripple NSA data centre' http://www.bbc.co.uk/news/technology-24443266 "It said civil contractors were confident the problem had been solved but a special US Army engineer investigation team had said the cause was "not yet sufficiently understood" to be sure that it would not happen again."

5 4