April 2014 - cypherpunks - lists.cpunks.org

NSA good guys
by Cypher 04 May '14

04 May '14

I wonder how long the good but misunderstood people over at NSA knew about Heartbleed and didn't disclose? I mean, certainly "protecting" us would necessitate them coming forward, right? The wouldn't deliberately leave the entire country vulnerable just so the could keep spying, right? Good people, my ass. Cypher Sent from my mobile device

21 53

Ubuntu bug 1308572
by Georgi Guninski 30 Apr '14

30 Apr '14

Ubuntu bug 1308572 https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 ----- affects ubuntu Hello, I am running Ubuntu 14.04 with all the packages updated. When the screen is locked with password, if I hold ENTER after some seconds the screen freezes and the lock screen crashes. After that I have the computer fully unlocked. -- Marco Agnese This bug is about the lockscreen being bypassed when unity crashes/restarts, which is a critcal security issue. The crash will be handled from bug 1308750 -----

2 2

DoJ tried to stop Barrett Brown's criticism of gov
by Douglas Lucas 28 Apr '14

28 Apr '14

This morning WhoWhatWhy published my new article, "Silencing Barrett Brown." I obtained the transcript of the hacktivist journo's September 4 gag hearing, which revealed bench conference conversations that were inaudible from the gallery when I attended. The transcript shows the prosecution asked the judge to stop Brown's wide-ranging criticism of the government in general, claiming that his anti-authority "tone" in one of his Guardian articles was "problematic." My article also provides an update on his case and plea deal. http://whowhatwhy.com/2014/04/28/silencing-barrett-brown/

1 0

Re: [Cryptography] GCC bug 30475 (was Re: bounded pointers in C)
by John Young 28 Apr '14

28 Apr '14

The criminal liability of NSA, other spies corps, orgs and comsec wizards in de facto complicit deception and exploitation of the public is a worthy topic to drag out of the hideaways. It might be demonizing of the valiant code warriors to be described as a Racketeer Influenced Criminal Organization operating under the cheerfully duplicitous Open Source. Open secrecy is the main tool of these sub rosa hoodlums, Mafioso mathematicians wiggling out of responsibility by algo shadiness and protestations of public service on behalf of working around censorship to free the slaves for better use producing cream for the privacy milkers. Top of the cream milkers adopt the aggrieved innocence when caught red-handed rustling public cattle, hello Mr. Bundy. So sue me, they laugh, knowing no jury could possibly grasp the arcane lingo the bozos use to semaphor signals about their nefaria promoted as good for the commonweal. Subsidize us, befuddled citz, kachink. A huge market ripoff, comsec, privacy and freedom of the Internet. Simple beginnings with a few crafty ne'er do well engineers, mathematicians and scientists, avoiding penal labor in labs, factories and spynests, setting up a quiet racket to control and monetize crypto, comsec and privacy while selling hacks and snitching to the fuzz downtown. Which has produced a boom in profits and reputations for the TLA- and nick-named coders, hackers, exploiters, leakers, promoters, apologists, yes, even populist heros and awards winners from Anonymous to Alexander to Snowden and this very list of who's who in wily coyotes. Code-wielding Corsicans never had it so good since the opening of the Internet frontier to unfettered gangsters claiming to be comsec enforcers for Judge Roy Bean west of Silicon Valley). Just saying howdy to my gang of cypherpunks free rangers for whom working around law-enforcement fences while informing, backdooring, and cheating on each other is top secret code of silence Omerta.

1 0

Poul-Henning Kamp
by dan＠geer.org 27 Apr '14

27 Apr '14

The talk Poul-Henning Kamp gave 12 Feb at FOSDEM http://www.youtube.com/watch?v=fwcl17Q0bpk parallels a half-dozen different threads found here. Carefully adjust your skepticism knob before listening (30m talk, 15m Q&A). --dan Scepticism is the chastity of the intellect; it is shameful to give it up too soon, or to the first comer. -- George Santayana

1 0

"Population Management"
by grarpamp 25 Apr '14

25 Apr '14

https://publicintelligence.net/identity-dominance/

1 0

AirChat radio, and cryptolaw
by grarpamp 24 Apr '14

24 Apr '14

https://github.com/lulzlabs/AirChat/ http://www.computerworld.com.au/article/543477/should_australians_prepare_r…

1 0

regulation on cybersecurity
by dan＠geer.org 23 Apr '14

23 Apr '14

The machinery is spinning up. And the Cobbler's Children Have No Shoes .... http://www.lawfareblog.com/2014/04/and-the-cobblers-children-have-no-shoes/ For those who prefer plaintext, lynx --dump yields the following And the Cobbler's Children Have No Shoes .... By [32]Paul Rosenzweig Monday, April 21, 2014 at 7:00 AM For quite some time, it has been apparent that the announcement of the [33]NIST Cybersecurity Framework would be a seminal event. Though couched as a voluntary program, many expected that [34]the Framework would become the de facto ground for liability. After all, if the National Institute for Standards and Technology has determined a baseline framework for optimal security in the cyber domain, [35]what could be more negligent than failing to meet that minimum standard? Unsurprisingly, the penny has begun to drop. Not, as one might have expected, in private sector tort suits, but in public sector regulatory action. Last week, the Securities and Exchange Commission[36] announced its intention to conduct an examination of the cybersecurity of 50 broker-dealers and investment advisers subject to its jurisdiction. The [37]questionnaire derives much of its content from the NIST Framework--so now the Framework will be the likely potential ground for regulatory action. How ironic then, that in the same week, [38]the GAO issued a report critical of the SEC for its own [39]lack of adequate cybersecurity and oversight. Perhaps the cobbler's children don't have any shoes .... 32. http://www.lawfareblog.com/author/paul/ 33. http://www.lawfareblog.com/2014/02/nist-cybersecurity-framework-issued/ 34. http://safegov.org/2013/11/1/the-nist-cybersecurity-framework-and-incentives 35. http://www.newrepublic.com/article/115187/cybersecurity-liability-court-cas… 36. http://www.digitalcrazytown.com/2014/04/sec-issues-nist-inspired-cybersecur… 37. http://www.sec.gov/ocie/announcement/Cybersecurity+Risk+Alert++%2526+Append… 38. http://www.gao.gov/products/GAO-14-419 39. http://online.wsj.com/news/articles/SB1000142405270230462630457950810040745…

3 2

Fine grain Cross-VM Attacks on Xen and VMware (AES)
by Griffin Boyce 23 Apr '14

23 Apr '14

'AES in a number popular cryptographic libraries including OpenSSL, PolarSSL and Libgcrypt are vulnerable to Bernstein’s correlation attack when run in Xen and VMware virtual machines, the most popular VMs used by cloud service providers.' Abstract: http://eprint.iacr.org/2014/248 Paper: http://eprint.iacr.org/2014/248.pdf So in a nutshell, if you want to steal a website's private keys, you can get an account on their hosting provider and at least have a shot at getting on the same physical server ;-) ~Griffin

2 1

Novena needs crowdfunding help
by Blibbet 22 Apr '14

22 Apr '14

They're 70% there, Bunnie needs help with rest. http://www.bunniestudios.com/blog/?p=3750 http://www.crowdsupply.com/kosagi/novena-open-laptop "$178,790 raised of $250,000 goal"

1 0