October 2013 - cypherpunks - lists.cpunks.org

Re: [serval-project-dev] More on mesh addressing.
by Paul Gardner-Stephen 24 Oct '13

24 Oct '13

Hello, Jeremy I think has answered the broadcast issue, so I will focus more on the entropy issue. On Thu, Oct 24, 2013 at 3:48 PM, Miles <myles(a)tenhand.com> wrote: > > > On Wednesday, October 23, 2013 9:18:36 PM UTC-7, Paul Gardner-Stephen > wrote: >> >> Howdy, >> >>> >>> I think it is better that we harvest a nice lump of entropy from the >> radios rather than install random data (that might give naughty people help >> reproducing your private keys). We could read RSSI levels from the UHF >> radio, hash it a couple of times, and feed some bits into the entropy pool. >> This would just require talking to the radio a bit, which isn't too hard. >> > Using the radio as a HWRNG is interesting. Wouldn't RSSI be easily > predictable (and influenceable) by any observer with an SDR radio? At the > very least you'd need to tune the radio to an unknown channel, bandwidth & > hopping code first. Or use the difference between the two radios in a > clever way. User space clock solutions like havaged or DakaRand seem > easier. > I think clocks are good to use, also. For the radio RSSI, we could easily make an entropy gathering mode where the radio hops over quite a wide band, perhaps from about 870MHz ~ 1000MHz in a random pattern sampling ambient energy levels, i.e. without talking to a remote radio, just listening. Combine that with some clock input, and feeding the RSSI results into the forward channel selection to help further randomise the hopping sequence while sampling for RSSI, and we should be able to make a fairly robust entropy source. Thoughts? Paul. > > >> >>> >>>> I am not sure how easy it would be to detect the address conflicts when >>> they occur (regardless of address range and size). It would probably >>> require some careful thought and work to implement it >>> >>> >> I agree that it is ugly in many ways, short of getting a doctoral student >> to work on the problem for a few years. Even then, we still need a solution >> until then. Let's keep thinking about it for a few days and see if either >> of us can come up with a good solution. >> > IP collisions could be an unintended accident or a deliberate DOS. In the > case of DOS, doing nothing seems better than amplifying/feeding the energy > monster. > > Using the Mac -> IP conversion, we know that any accidental collision will > share our last 3 MAC bytes. But the odds are very good they won't share > bytes 2-3. > RARP/ARP/RARP would be awesome if it didn't fail for hidden/distant/lossy > nodes. > > Nodes with IP address conflicts can still send and receive broadcast > traffic. What is serval already broadcasting that we could use to look for > trouble unicasting? > Broadcast to nearest node's (serval?) echo service, unicast to them, if > the response doesn't come back, re-Ip? > > -- > You received this message because you are subscribed to the Google Groups > "Serval Project Developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to serval-project-developers+unsubscribe(a)googlegroups.com. > To post to this group, send email to > serval-project-developers(a)googlegroups.com. > Visit this group at > http://groups.google.com/group/serval-project-developers. > For more options, visit https://groups.google.com/groups/opt_out. > -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out.

1 0

Re: [Cryptography] [RNG] on RNGs, VM state, rollback, etc.
by Russ Nelson 24 Oct '13

24 Oct '13

Tony Naggs writes: > I think you a overestimating how much real entropy you will collect this > way [ through powerline drift.] Indeed. By the time you set up a powerline interface, you may as well just reverse-bias a diode, compare it to a low-pass-filtered version of itself, and capture that noise. You could do it with a DigiSpark, and get a USB bytestream. 100% open source, 100% auditable. http://digistump.com/ -- --my blog is at http://blog.russnelson.com Crynwr supports open source software 521 Pleasant Valley Rd. | +1 315-600-8815 Potsdam, NY 13676-3213 | Sheepdog _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 2

[Bitcoin-development] Core Development Update #5
by Melvin Carvalho 24 Oct '13

24 Oct '13

https://bitcoinfoundation.org/blog/?p=290 Very excited about this, particularly the 80 bytes embeddable message. I do believe satoshi mentioned he wanted to add short messages, at some point. Great work Gavin & all! ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development

1 0

Curious RNG stalemate [was: use of cpunks]
by grarpamp 24 Oct '13

24 Oct '13

On Thu, Oct 17, 2013 at 2:29 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > If we had good PRNGs everywhere, with lots of trustable physical entropy > stirred in then nobody would care about talking about these. > It would be boring, since a solved problem. > > Now show me a cryptographic quality PRNG with a few MBytes of > internal state. Best, a whole robust family of them. See? That's > some quality trolling, right there. Problem is, apparently no one is solving it, so round and round it goes... physical entropy, rdrand, reboot state, prng code. I'd guess that with good sources, today's prng code is sufficiently strong and at least some unix systems do save state across reboot. Now if someone would just sell a completely open discrete logic serial port hw entropy source for under $50... that would end a lot of the talk. Even with a more costly radiation source rather than other phenomena you'd still likely make good profit in quantity from China at that price. Sell other/cheaper/slower phenomena for a little less and make even more profit. Seal some up in a pretty wrapper and call it the corporate version for $1500.

14 19

Undernet IPv6 Interop [was: Enigmabox/cjdns]
by grarpamp 24 Oct '13

24 Oct '13

On Tue, Oct 22, 2013 at 4:51 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > Just got word, Enigmabox has published source and > put up first documentation on http://wiki.enigmabox.net/ This is cjdns. Last I checked (and will again) I'm pretty sure they were using an IPv6 address scheme that would conflict with other projects using proper private space. So if say you wanted to run an interface for each project and run/access/route them all at once, you can't. Yes, less than 128bits (say a /48) is pretty weak... but when you can't interoperate [1] that leaves something to be said for each project to develop an address layer so you can. There certainly won't ever be more than 2^48 projects or 2^80 users. The undernets are getting bigger and having more projects. They might want to be thinking about interop beforehand. Otherwise, even though the tech under the hood might be different, to the user they will appear as bunch of balkanized communities, and a real pain to use any of them in parallel. [1] Click on a link to service on any net from a page on any net and let your host do the routing to get you there. Where any net = i2p/tor/freenet/phantom/cjdns/anonet/gnunet/etc. At least four of these do have some IPv6 route capability, but I thnk only a couple work together reasonably well.

2 2

[liberationtech] the virtual revolution in Second Life -- virtual model or just more RL?
by Shava Nerad 24 Oct '13

24 Oct '13

A virtual trip report with the strongest insider activist biases. Probably if anyone wants a paper out of this, I'm a subject, not an author. Perhaps a small thing in the larger world, where Tor has been in the headlines for Silk Road and amusing powerpoint presentations by the NSA this week, eh? But in the world of tiny virtual first-world-problems, I am also an art performance celebrity/Buckaroo Banzai type in virtual space. tldr links: http://quora.com/What-are-some-brain-hacks-that-neuroscientists-psychologis… http://www.youtube.com/watch?v=3ukKCWRJudM (getting our act slotted on NBC's America's Got Talent) http://www.businessweek.com/stories/2008-02-14/so-i-married-an-avatarbusine… http://npirl.blogspot.com/2008/02/tunas-trippy-textures.html http://www.youtube.com/watch?v=IiAG06k9m7o (one of a series of stealth edu machinima produced for German TV) http:oddfellowstudios.com We have a following of some reasonable thousands on SL, even though we've been in slack mode for a couple years, since this is, needless to say, not a money maker. But it is community. The Second Life community is notable for its to-me loveable and often neurotic population of fannish, high percentage (I'm not) transhumanist digital natives who make "digital native" an absolute in a way unheard of in most gaming or social media contexts. As such, this community is an interesting vanguard for social, legal, and other bubbling up phenomena before they hit more sociotypical online society. With a higher percentage of ASD, disabled, homebound, socially isolated folks, as well as a higher percentage of cultural creatives, intellectuals, educators, DIY/makerspace each-one-teach-one types, medical outreach groups, activists, self-help group facilitators and coaches, human rights advocates, (para)military trainers, wisdom teachers, and other engaged intellectuals (often meshing in Venn diagrams) -- whose silos sometimes interact or not with a vast majority of consumers who are just there to party and buy cool clothes, dance, and hook up -- it's a weird weird weird weird virtual world. When it came to light recently that Linden Lab, operator of Second Life, had made some incredibly draconic changes to their TOS, the community freaked. And LL went to New World Notes (the primary metagame media) and smoothed things out with PR, for the most part. Then I saw the TOS more recently through an individual blog article in the arts community (as I said, we're a bit behind and in slack mode) and freaked, myself, and posted here a couple weeks ago. As a result, in the intervening time, there's been a turnaround in community opinion the issue. We catalyzed a great deal of that. Oddfellow Studios (that being me and Fish Fishman, aka Shava Suntzu and Tuna Oddfellow in virtual space) pulled our stuff and moved to Inworldz, an open source grid (imagine a miniature version of Second Life with a thousands rather than millions of users -- a public private server, so to speak, still with a real-money economy, and with the same asset server type so you can import your own assets -- and violating license could conceivably rip other peoples' (c) but we don't, or could import certain FOSS licensed assets which we have). We were back up and running a rough equivalent to our show within a week, including our monthly collaboration with JaNa KyOmOoN (AKA Jan Pulsford, keyboardist to Cyndi Lauper) with whom we do two monthly dates cross continent, us in New England, her in England. Because we are art performance folks and our fans tend to early adopters even for SL, I think a lot of our fans weren't hesitant to "jump grids" and become metaversals -- this is to say, they just registered with Inworlds, created a new avatar, loaded up the very similar client, and came to enjoy the show. The shows in SL got press coverage too, showing how easy it was to move, and how people moved with us as our fan base. Through all this, I worked the metagame press, as well as blogging and discussing the issues in and out of game, as did Tuna. Language and backgrounders we crafted began to propagate, and went unopposed by any official pushback by the Lab, New World Notes did a dramatic turnaround on their position when I pointed out that a perpetual irrevocable license (including rights to reassign/sell/resell) means that if, say, the Lab goes tits up, all assets go into receivership and anything in the SL asset server is up for auction if it isn't marked by copyright -- hunting down your assets to defend them is up to the owner in that case (IANAL but I did used to work in entertainment licensing). By the time you straighten things out tracking and defending your copyrights, as I pointed out, your legal help better be free. NWN went to the Lab for comment a couple weeks ago. Got none presumably. I think Hamlet/NWN felt somewhat played by the previous PR response he'd gotten. He's solidly on the dissent side of the question now, perhaps feeling like he was likely responsible for people making bad decisions in the first round, although I haven't directly asked him that -- seems like bad form. Though the Lab hasn't officially responded, an interesting, quite erudite comment that opened "Well, I'm not a creator in SL and I don't have a horse in this race but..." on New World Notes signed "imho" supported the Lab's position with expert legal language -- conflating several points masterfully. I refuted it, and postulated "This might not be a very humble opinion, but might even be Humble's [the Linden Lab current CEO's] opinion." "imho?" lol. While I've been ill, one of my sidelines for income has been working as a ghost writer because I have a great ear for different writers' cadence and style. 'nuff said... Now the "bug" is spreading from the arts community to educators and many other communities that have been long time conservative land holder blocs (this is to say, income producers and also PR anchors that are not pr0n) in SL. Intellectual foment is taking over, as is often the case in RL governmental stonewalls of this sort. Movement momentum is reaching, if it hasn't reached, a tipping point, and the brain drain is likely unstoppable. Several major vendors of intellectual property (textures, art assets) have pulled their relationship with SL, stopped selling and forbidden creation of new assets with their assets in SL. Creators are leaving SL in droves for alternate open source grids. The mothership is emptying out, at least experiencing a brain drain of a vibrant population that characterized it's first generation, the generation that made it "Second Life," the dream of its own mad (social) scientist creator, founding CEO Philip Rosedale. Every week that LL withholds action and further comment, they are heading further toward a future more like There.com (an authoritarian barbie-and-ken-and-einstein-on-the-beach dead virtual world that was entirely company authored content) and less like the Burning Man inspired "Your World, Your Imagination" user-created economy envisioned a decade ago. So my assumptions are: They have to know what's going on. They aren't STOOPID. They are either constrained in action. Or they want us out. Or they find the cost acceptable. Or some amalgam thereof. It seems to me that the company is too small for them to be slow to act, which is another possibility in a very large company or bureaucracy. But I'll include that as a gridlock staff/board conflict, say, as a low possibility. Never underestimate the paralysis potentiality of politics. Look at DC. Another interesting aspect becomes the influence of the government crackdown on the Linden Dollar as a "bitcoin" like currency exchange. Several Linden Lab independent linden dollar currency exchanges were shut down in dramatic style earlier this year with the loving interference of the US government, and only two were reopened after undisclosed negotiations having to do with PII, it seems (although more have opened since) -- so this does have some legit overlap with interests on this list...heh... I've even entertained for a fleeting moment that they have some sort of weird NSL thing going on...NAH... C'mon Shava... Not every uncommunicative stonewall from an internet company you like has an NSL behind it... These are just odd times. http://slnewser.blogspot.com/2013/05/most-third-party-linden-exchange.html But interference in the exchanges could also lead to FUD within the investors, a new strength to the internal political clout of the legal department, and many other destabilizing issues (the PR department explanation for the new TOS is that Legal wants "a unified TOS across all the Linden Lab businesses," which include game companies with no user created content. My refutation to this was that if they were running a truck fleet and an airline fleet for shipping businesses, their legal department would be fools to use the same liability and shipping guarantees for both companies. What are other pressures on a company like LL, their board/investors, and the future of Internet culture that leads to moves like this these days? What will it mean to the diaspora of creators to move into a cloud of small grids and how will that be a model for systems like Diaspora and more traditional forms of social networking? Seems to me this is a mesh of issues that bears watching for some folks here. I understand Second Life has been so "over" for at least a half dozen years, but we've been ahead of the game(s) (and distinctly off center) for at least a decade, so we make up for it. ;) yrs, -- Shava Nerad shava23(a)gmail.com -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

5 4

Re: Curious RNG stalemate [was: use of cpunks]
by Bill Stewart 24 Oct '13

24 Oct '13

At 09:56 AM 10/17/2013, grarpamp wrote: >I'd guess that with good sources, today's prng code is sufficiently >strong and at least some unix systems do save state across reboot. >Now if someone would just sell a completely open discrete logic >serial port hw entropy source for under $50... that would end >a lot of the talk. Even with a more costly radiation source rather >than other phenomena you'd still likely make good profit in quantity >from China at that price. First of all, lots of important hardware doesn't have ports on it, particularly virtual machines, which have a whole raft of issues even if you're running them on a server you physically control rather than somebody else's cloud service. The server has some ports, but you need to make sure your hypervisor and clients have drivers that will let the client access the hypervisor's /dev/random or equivalent. VMware will have to do their own; you might contribute to OpenStack. Another important kind of hardware where that doesn't work are home routers, because the market price of $29-99 can't support much extra money for randomness hardware; if it's not in the ARM core or whatever other low-power cheap CPU, then it's only going to be able to extract entropy from timing and network traffic, and there's unlikely to be a high-precision clock chip. Maybe you can get the manufacturer to burn a pseudo-random number into the box along with the ethernet MAC or something, but otherwise it's going to have to be software. (So maybe you can augment Tomato/WRT-11/etc to listen for traffic for a while before starting, and write an app for your PC that beacons some entropy for the router to listen to?) As far as your entropy dongle goes, the only way to get it cheap is to make large volumes, which means you need a device that's intended for some other application, like a $20 TV tuner/audio frob or a webcam in a dark can getting CCD noise, or a webcam you wave at. If you want speed, you need USB, not serial, but that's fine, because almost nobody's including real serial ports these days. If you want slow, you can get a geiger counter from Sparkfun/etc. for ~$99, but you're not going to get anything intentionally radioactive shipped cheap from China.

9 14

Linux Kodachi
by Trigger Happy 24 Oct '13

24 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Check out new Tor distro - Linux Kodachi http://www.digi77.com/linux-kodachi/ http://sourceforge.net/projects/linuxkodachi/ - -- Trigger Happy jabber: triggerhappy(a)jabber.ccc.de torchat: xruq34bnhbqlkjtn -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJSZscrAAoJEEtm9wC9fGLFq+kP/R1Nxd+wXe9P/Y2PNjwAHyZf Y4xc6RdMoPraOmtaqB1u7V8b7VheLZH6n+bLAl9qD+JqEwVDOx5/vzVFjibqsj9H zi4ndhbY/p2+QvYZKx2BiDBMtaoqrXm9GF0ELLK02xtvSaNVNRpupCx2foqHlMSv GRT0IACaUhIFV1e75CY7wwqZpLujKjVHW2cjhCltI5FHS+wpVBcSh9TFsMz50plV 4XK6rnABw23B9ElDcwHi06J+k6tvPR2vp0jDo5FvQi3m3ijjSk1dfXpBcZS/b2nB 92YnQEa/24EsbhYlHWVXkSk8hno+lgdKOPsaJ3/TNKfD7tfnet8FcyosDB6MHqwI kq4gSI72Nopz1xWIw9++P+Iq8q1QR6bWCHIq79BfPJMUWV/09fAosyp4QhoaxfYe iXlkCeZXmtMeMKJzKhm73E1NRR8nydNFlHq4HuZaV/k4JdxiPE0FbdtNzpY9lVAt scOv/BkVNeaReunOBrilIEwsdzPDr46EfrJG0rsSew4qSHJoQxwy3kJDzkhwMJVa MiplHmayXlAAVf+yIe4fwG0DdGq90qtwru3h0qLVQysOhkUNxgbSSm+GP08Pmw/S tuPXd3vAEQ6MjkQMZJIxMAeA5mo7PGo3wxk7lIl0/oyDUaY7ChghYl5t7gu3KOoF v+jvEOHoCemt61p+zCY7 =SEEQ -----END PGP SIGNATURE-----

7 7

[RISKS] Risks Digest 27.57
by RISKS List Owner 24 Oct '13

24 Oct '13

RISKS-LIST: Risks-Forum Digest Wednesday 23 October 2013 Volume 27 : Issue 57 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/27.57.html> The current issue can be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Wall Street software failure & relationship to voting (Jeremy Epstein) SecureDrop Project Will Pay To Install Media Outlets' WikiLeaks-Style Submission Systems (Andy Greenberg via Gabe Goldberg) Authors Accept Censors' Rules to Sell in China (Andrew Jacobs via Lauren Weinstein) MIT Tech Review: The Decline of Wikipedia (Tom Simonite via Lauren Weinstein) `Hacker' --> `criminality' ??? (Robert Schaefer) Re: France summons US ambassador to answer allegations of widespread NSA surveillance (Richard A. O'Keefe) Re: Americans Are Way Behind in Math, Vocabulary, and Technology (Richard S. Russell) Re: GPS map leads to border crossing and shooting (Scott Nicol) Unauthorized Access: The Crisis in Online Privacy and Security, by Sloan and Warner (PGN) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Wed, 23 Oct 2013 21:51:42 -0400 From: Jeremy Epstein <jeremy.j.epstein(a)gmail.com> Subject: Wall Street software failure & relationship to voting [Also posted to Freedom to Tinker, slightly PGN-ed for RISKS.] An article in *The Register* explains what happened in the 1 Aug 2012 Wall Street glitch that cost Knight Capital $440M, resulted in a $12M fine, and nearly bankrupted Knight Capital (forcing them to merge with someone else). In short, there were 8 servers that handled trades; 7 of them were correctly upgraded with new software, but the 8th was not. A particular type of transaction triggered the updated code, which worked properly on the upgraded servers. On the non-upgraded server, the transaction triggered an obsolete piece of software, which behaved altogether differently. The result was large numbers of incorrect "buy" transactions. The bottom line is that the cause of the failure was lack of careful procedures in how the software was deployed, coupled with a poor design choice that allowed a new feature to reuse a previously used obsolete option, which meant that the trigger caused an unanticipated result (instead of being ignored of causing an error). So, what does this have to do voting? It's not hard to imagine an Internet voting scheme using 8 servers, and even if the software doesn't have security flaws per se, a botched upgrade like this might work just fine for 7/8 of the voters, and silently fail for the 1/8. If the procedures aren't in place to check all of the systems (and such procedures apparently didn't exist at Knight Capital), a functional check might not detect a mismatch. This experience emphasizes that proper operation isn't *just* having the software itself being built correctly -- it's also having it fielded properly. In a way, this is similar to the DC Internet voting experiment -- in that case, there was a bug in the software, but that particular bug wouldn't have been exploitable if it hadn't been for a mistake in how the software was fielded, replacing one version of a software library with a different version that had an exploitable bug. [This is not to suggest that this was the only bug in the DC voting software, or that Internet voting is safe, just tying to the particular exploit that happened.] Background: http://www.theregister.co.uk/2013/10/23/lone_sysadmin_caused_462_meeellion_… http://www.usatoday.com/story/money/business/2013/10/16/knight-capital-sec-… ------------------------------ Date: Wed, 23 Oct 2013 12:01:20 -0400 From: Gabe Goldberg <gabe(a)gabegold.com> Subject: SecureDrop Project Will Pay To Install Media Outlets' WikiLeaks-Style Submission Systems (Andy Greenberg) Andy Greenberg, *Forbes*, 15 Oct 2013 The non-profit Freedom of the Press Foundation (FPF) announced the launch of SecureDrop, a piece of open-source software designed to serve as an anonymous submission systems for media organizations. And to encourage news outlets to install it, the Foundation has offered to send one of SecureDrop's creators, security consultant James Dolan, to willing news outlets to help install it, in some cases even paying for the necessary hardware. SecureDrop, which like WikiLeaks depends on the anonymity software Tor to hide leakers' identities, was developed from the open-source software DeadDrop, initially created by the late coder and activist Aaron Swartz along with Dolan and Wired editor Kevin Poulsen. http://www.forbes.com/sites/andygreenberg/2013/10/15/securedrop-project-wil… ------------------------------ Date: Tue, 22 Oct 2013 21:58:40 -0700 From: Lauren Weinstein <lauren(a)vortex.com> Subject: Authors Accept Censors' Rules to Sell in China (Andrew Jacobs) "Foreign writers who agree to submit their books to China's fickle censorship regime say the experience can be frustrating. Qiu Xiaolong, a St. Louis-based novelist whose mystery thrillers are set in Shanghai, said Chinese publishers who bought the first three books in his Inspector Chen series altered the identity of pivotal characters and rewrote plot lines they deemed unflattering to the Communist Party. Most egregiously, he said, publishers insisted on removing any references to Shanghai, replacing it with an imaginary Chinese metropolis called H city because they thought an association with violent crime, albeit fictional, might tarnish the city's image." http://j.mp/1dh4BGA (New York Times via NNSquad) [The article also notes the extensive redaction of a biography of reformist leader Deng Xiaoping written by Ezra F. Vogel. I presume this issue of RISKS will also be censored or redacted in China. PGN] ------------------------------ Date: Tue, 22 Oct 2013 22:22:59 -0700 From: Lauren Weinstein <lauren(a)vortex.com> Subject: MIT Tech Review: The Decline of Wikipedia (Tom Simonite) "Yet Wikipedia and its stated ambition to "compile the sum of all human knowledge" are in trouble. The volunteer workforce that built the project's flagship, the English-language Wikipedia-and must defend it against vandalism, hoaxes, and manipulation-has shrunk by more than a third since 2007 and is still shrinking. Those participants left seem incapable of fixing the flaws that keep Wikipedia from becoming a high-quality encyclopedia by any standard, including the project's own. Among the significant problems that aren't getting resolved is the site's skewed coverage: its entries on Pokemon and female porn stars are comprehensive, but its pages on female novelists or places in sub-Saharan Africa are sketchy. Authoritative entries remain elusive. Of the 1,000 articles that the project's own volunteers have tagged as forming the core of a good encyclopedia, most don't earn even Wikipedia's own middle-ranking quality scores. The main source of those problems is not mysterious. The loose collective running the site today, estimated to be 90 percent male, operates a crushing bureaucracy with an often abrasive atmosphere that deters newcomers who might increase participation in Wikipedia and broaden its coverage." http://j.mp/1a6l6UL (MIT via NNSquad) ------------------------------ Date: Tue, 22 Oct 2013 13:32:54 -0400 From: Robert Schaefer <rps(a)haystack.mit.edu> Subject: `Hacker' --> `criminality' ??? In the eyes of the court, calling yourself a hacker is equivalent to admitting criminality: http://yro.slashdot.org/story/13/10/22/153259/call-yourself-a-hacker-lose-y… http://www.digitalbond.com/blog/2013/10/22/call-yourself-a-hacker-lose-your… robert schaefer, Atmospheric Sciences Group, MIT Haystack Observatory Westford, MA 01886 781-981-5767 http://www.haystack.mit.edu ------------------------------ Date: Wed, 23 Oct 2013 18:18:14 +1300 From: "Richard A. O'Keefe" <ok(a)cs.otago.ac.nz> Subject: Re: France summons US ambassador to answer allegations of widespread NSA surveillance http://catless.ncl.ac.uk/Risks/27.56.html#subj9 tells us that the French government are unhappy about the NSA. Let's see where the logic takes us. 1. Blowing up a vehicle in a foreign city and killing an unarmed civilian is a terrorist act. 2. An organisation that trains, equips, and commands such an act is a terrorist organisation. 3. Anyone who contributes to the funding of such an organisation is supporting a terrorist organisation. 4. Anyone who supports a terrorist organisation is a legitimate target of surveillance in the war against terror. 5. In 1985, the French government carried out such a terrorist act in the largest city of my country. http://en.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warrior 6. Therefore every French taxpayer is a legitimate target of surveillance and the French government have no grounds for complaint. Of *course* there are flaws in this (except for 5, which is a legally established fact). But it's frighteningly plausible if you don't stop to think. And it's exactly the kind of "reasoning" that is easy to embody in computer software. (Maybe I should have written these claims using OWL...) Is there anyone, other perhaps than the inhabitants of a few villages in PNG and Vanuatu, that we _can't_ cover this way? ------------------------------ Date: Mon, 21 Oct 2013 22:08:47 -0500 From: "Richard S. Russell" <richardsrussell(a)tds.net> Subject: Re: Americans Are Way Behind in Math, Vocabulary, and Technology (Davidson, RISKS-27.56) If American kids had to take their reading and writing tests in Spanish rather than English, we wouldn't expect them to do very well, since Spanish isn't the first language for most of them. Yet we expect them to take science and math tests which are written using metric units -- the international "language" of technology. And we SHOULD expect this! The sad part is that, while metric units are the first language of measurement for 95% of the world's population, they remain a foreign tongue to almost every American, with commensurate results. Ben Franklin advocated the metric system. Congress adopted the Metric Conversion Act of 1975, and it looked as if we were finally on our way. But then Ronald Reagan was elected president, took the solar panels off the White House roof, and declared that there was no way any government reporting to him was going to dictate measurement rules to business. "Let the free market decide", he insisted. And metrication came to a dead halt. We continue to pay the price today, not only in substandard education but also in failure to manufacture to the kind of international standards that might earn us foreign markets. Plus which, ACHU* makes us dumber, almost as if we had to do all our math using Roman numerals. * Accidental Collection of Heterogeneous Units -- don't mislabel it the "English system". First off, it's not a system (no design), it's an accident. 2nd, the English have come to their senses and metricated decades ago. And for gosh sake don't call it the "American system", because then all the super-patriots will insist that it's a matter of national honor to stick to it. Richard S. Russell, 2642 Kendall Av. #2, Madison WI 53705-3736 608+233-5640 http://richardsrussell.livejournal.com/ If God had wanted us to use the metric system, he would have given us 10 fingers. Ashleigh Brilliant ------------------------------ Date: Tue, 22 Oct 2013 10:53:33 -0400 From: Scott Nicol <scott.nicol(a)gmail.com> Subject: Re: GPS map leads to border crossing and shooting (DeRobertis, RISKS-27.56) In RISKS-27.56, Anthony DeRobertis writes: > This is the most misleading Subject: line I can remember having appeared in > RISKS. Hyperbole in RISKS subject lines? Inconceivable! I cross borders often and it is never routine. I've been "delayed" 6 times (that I recall) at the US/Canada border, even though I had my papers in order. Some of those were probably due to fitting a profile, other times because I won the let's-randomly-check-somebody lottery. If you come without papers, you've won the lottery by default. Anything can happen once they pull you aside and start digging. The border crossing guard won't likely take your story at face value. Even between friendly nations like Canada and the US, there are plenty of things that could result in something much more serious than a delay when crossing the border. You look Mexican. Your last name is Mohammed. You look like a terrorist. You don't sound or look like a Canadian. You are not a Canadian citizen, where's your US visitor visa? Or you have kids in your car. Where is the other parent? Why does that kid not look like you? Is that baby really yours? Perhaps you're carrying contraband? Cuban cigars? Kinder Eggs? http://www.cbc.ca/news/canada/manitoba/kinder-surprise-egg-seized-at-u-s-bo… http://www.cbp.gov/xp/cgov/newsroom/news_releases/national/2012_nr/apr_2012… Drugs? Some medications with codeine are available over the counter in Canada, but only legal with a prescription in the US. You are carrying marijuana, or your buddy in the passenger seat is, or a friend stuffed some under a seat cushion last week. The US will seize your car on the spot, but you don't have to worry about transportation because you'll get a free ride in the back seat of a government car. You have a prior criminal record. You have been barred from entering the US. You have a warrant in the US. You have too much beer in the trunk of your car. Regardless if they let you through or turn you around, you'll have to go through customs on return to Canada and you can run into the same set of problems, and even more because there are legal reasons why you may not be allowed to leave (you are out on bail, probation, parole) or return (single-entry visa) to Canada. And yes turning around means going through Canadian customs, because the US customs house is on US soil. What could possibly go wrong? What if you aren't admissible to Canada or the US? How do you think people get stuck in limbo in airport terminals? ------------------------------ Date: Tue, 22 Oct 2013 16:42:07 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Unauthorized Access: The Crisis in Online Privacy and Security (Sloan and Warner) Robert H. Sloan and Richard Warner Unauthorized Access: The Crisis in Online Privacy and Security CRC Press, 2014 xxiii+374 Robert Sloan is a professor of computer science, and Richard Warner is a law professor, which would seem to make a nice collaboration. However, this book is explicitly aimed primarily at legal and policy folks, rather than techies. The back jacket says that this book ``proposes specific solutions to public policy issues pertaining to online privacy and security.'' It is highly readable, and could be very helpful for those who are not yet aware of the serious issues it raises and the remedies it proposes. On the other hand, it seems much less specific in discussing the implications of many of the security problems (such as pervasive vulnerabilities and exploits) whose existence might make some of the legal and policy issues less effective, or whose remediation might possibly make the recommended fixes less necessary. Also, there seem to be many inherent weaknesses in best practices (not just in those proposed), as well as likely limitations in legal remedies that might still exist despite the authors' recommendations. A second edition might dig further into some of these additional considerations. However, their recommendations certainly deserve serious consideration -- especially given the poor state of the technology for security, integrity, reliability, and so on. Overall, policy and law are important -- if properly enforced. At the same time, they are not enough by themselves -- especially in the absence of meaningful trustworthiness of systems, networks, and people. I have a few quibbles with the title of the book that may be familiar to long-time RISKS readers, first with `Unauthorized Access', and second with `Online Privacy and Security'. As we should learn from studying exploits such as the Internet Worm and the Snowden affair, many of our problems in this area involve Authorized Access rather than Unauthorized Access, especially relating to policies, ethics, and the law. For example, as I noted in RISKS-12.15 relating to the Internet Worm, no authorization was required to exploit the sendmail debug option, the finger daemon buffer overflow, freely open-to-the-world .rhosts files, and explicitly readable encrypted password files. This fact seriously muddied the waters in a prosecution that was based on Exceeding Authority when no authority was actually required. Similarly, denial-of-service attacks frequently require no authority, even when they manage to exploit fundamental flaws in security. Worse yet, privacy violations often exist outside the purview of computer system authentication and access controls, in which case it is not at all clear what is actually `unauthorized' once the information involved has become extrinsic to the systems in which it originated. Thus, offline privacy is perhaps just at least as problematic as online privacy, while offline security seems to be more of a fantasy. Besides, as I noted in my Inside Risks column, The Foresight Saga, Redux (Comm.ACM 55, 10, Oct 2012, http://www.csl.sri.com/neumann/cacm228/pdf) although the best may be the enemy of the good, the good may not be good enough. ------------------------------ Date: Sun, 7 Oct 2012 20:20:16 -0900 From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. The mailman Web interface can be used directly to subscribe and unsubscribe: http://lists.csl.sri.com/mailman/listinfo/risks Alternatively, to subscribe or unsubscribe via e-mail to mailman your FROM: address, send a message to risks-request(a)csl.sri.com containing only the one-word text subscribe or unsubscribe. You may also specify a different receiving address: subscribe address= ... . You may short-circuit that process by sending directly to either risks-subscribe(a)csl.sri.com or risks-unsubscribe(a)csl.sri.com depending on which action is to be taken. Subscription and unsubscription requests require that you reply to a confirmation message sent to the subscribing mail address. Instructions are included in the confirmation message. Each issue of RISKS that you receive contains information on how to post, unsubscribe, etc. => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines. => .UK users may contact <Lindsay.Marshall(a)newcastle.ac.uk>. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you NEVER send mail! => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. *** NOTE: Including the string "notsp" at the beginning or end of the subject *** line will be very helpful in separating real contributions from spam. *** This attention-string may change, so watch this space now and then. => ARCHIVES: ftp://ftp.sri.com/risks for current volume or ftp://ftp.sri.com/VL/risks for previous VoLume http://www.risks.org takes you to Lindsay Marshall's searchable archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue. Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r <http://the.wiretapped.net/security/info/textfiles/risks-digest/> . ==> PGN's comprehensive historical Illustrative Risks summary of one liners: <http://www.csl.sri.com/illustrative.html> for browsing, <http://www.csl.sri.com/illustrative.pdf> or .ps for printing is no longer maintained up-to-date except for recent election problems. *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 27.57 ************************

1 0

[cryptome] Re: Tapping Angela Merkel
by John Young 24 Oct '13

24 Oct '13

All these passionate reports refer to the hyped Der Spiegel piece, slathered with additional hype, padded with dated filler, mused wanderings across the Snowden veldt. The key document that has set techies pushing "credible evidence" appears to be a two-page outline released by Le Monde titled "Close Access Sigads" which lists a batch of techie-like techniques used to intercept comms. http://cryptome.org/2013/10/nsa-close-access-sigads.pdf There has been discussion of these tricks around tech circles due to the sparsity of technical information in most of the Snowden releases in favor of generalities beloved tech-illiterate journalists and their readers. It is likely some techies fed tips and luridities to the German spies (most of whom are also tech-illiterate and must rely on tech-aware recruits and contractors who are treated with disdain by old HUMINT-seasoned salts). Given a bit of goose by the techie informants, the German spies saw a great way to boost their tech budget, and leaped into action. Same as in the US adminstration and Congress and their kind around the world. Devilish comsec techies are nothing if not opportunistic, MIT and Silicon Valley born and bred, and pray nightly many Mannings and Snowdens will continue to valorize their career of code and hack hoakum. Mea culpa maxima. Have you seen our media campaign? At 07:48 PM 10/23/2013, you wrote: >http://www.theguardian.com/world/2013/oct/23/us-monitored-angela-merkel-germ >an

1 0