January 2016 - cypherpunks - lists.cpunks.org

Standard Operating Procedure 303
by Rayzer 01 Mar '16

01 Mar '16

On January 8 2016 the US Supreme Court will consider a petition for certiorari in the EPIC v. DHS "Standard Operating Procedure 303" FOIA suit. SOP 303 is also known as the 'National Emergency Wireless Kill-Switch' “Standard Operating Procedure 303,” is the protocol that codifies a “shutdown and restoration process for use by commercial and private wireless networks during national crisis.” Moreover, the justices are expected to clarify: “the scope of FOIA’s “Exemption 7(F),” which allows the government to withhold “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information … could reasonably be expected to endanger the life or physical safety of any individual.” The central question raised by Exemption 7(F) is whether the government has to be able to identify with any specificity the “individual” whose life or physical safety might be endangered by disclosure of the requested law enforcement records. In 2008, the Second Circuit answered that question in the affirmative in ACLU v. Dep’t of Defense. In its February 2015 decision affirming the government’s rejection of EPIC’s FOIA request, the D.C. Circuit held expressly to the contrary. As I explain in the post that follows, not only is this division of authority sufficiently important so as to justify the Supreme Court’s intervention no matter how the Court ultimately rules, but, in my view, the Second Circuit clearly has the better reading of Exemption 7(F) as a matter of statutory purpose, structure, and policy. I. The Second Circuit and the PNSDA The story begins with FOIA requests filed in 2003 by the ACLU and other organizations seeking records related to the treatment and death of detainees held in US custody overseas after September 11, and records related to the practice of “rendering” some of those detainees to countries known to use torture. The litigation over the ACLU’s request eventually reduced to a dispute over at least 29 (and perhaps thousands of) photographs of detainees and detainee abuse in Afghanistan and Iraq. In June 2006, the district court ordered the release of 21 of those photographs (with proper redactions to alleviate privacy objections), and the government appealed, arguing that the photographs were covered by Exemption 7(F) insofar as their release would likely incite violence against US personnel in Afghanistan and Iraq.” In full with links at Just Security https://www.justsecurity.org/28485/foia-circuit-split-supreme-court-resolve/ -- RR "You might want to ask an expert about that - I just fiddled around with mine until it worked..."

3 6

Re: [cryptome] Re: FOIPA adventures
by coderman 29 Feb '16

29 Feb '16

two new for DOCSIS tech @FBI, @CIA: "Any and all "DOCSIS" technology records, including cross-references and indirect mentions, including records outside the investigation main file. This is to include a search of each of the following record stores and interfaces: the Central Records System (CRS), the Automated Case Support system ("ACS") Investigative Case Management system ("ICM"), the Automated Case Support system ("ACS") Electronic Case File ("ECF"), and the Automated Case Support system ("ACS") Universal Index ("UNI"). I also request a search of "ELSUR", the database containing electronic surveillance information, for any and all records or activities related to "DOCSIS" or "DOCSIS intercept" or "DOCSIS access" technology. In addition, please extend the search criteria across any external storage media, including I-Drives, S-Drives, or related technologies used during the course of investigation involving Cable internet data services. DITU experimental technologies or research also within scope of this request. Please include processing notes, even if request is denied in part. Please identify individuals responsible for any aspect of FOIA processing in the processing notes, along with explanation of their involvement if not typically assigned FOIA responsibilities for the record systems above." - https://www.muckrock.com/foi/united-states-of-america-10/indocsis-19725/ "Any and all records, receipts, training, technology transfer programs, research, evaluation technologies, or other materials relevant to "DOCIS" cable communication technology. This is to include "DOCSIS 1.0", "DOCSIS 2.0", "DOCSIS 3.0", and other relevant DOCSIS protocols." - https://www.muckrock.com/foi/united-states-of-america-10/indocsisxfer-19726/ On 7/12/15, coderman <coderman(a)gmail.com> wrote: > On 7/12/15, Douglas Rankine <douglasrankine2001(a)yahoo.co.uk> wrote: >> Are they giving reasons for the rejections? > > Glomar all around. see also: > > "What Is the Big Secret Surrounding Stingray Surveillance?" > - > http://www.scientificamerican.com/article/what-is-the-big-secret-surroundin… > > --- > > What Is the Big Secret Surrounding Stingray Surveillance? > > State and local law enforcement agencies across the U.S. are setting > up fake cell towers to gather mobile data, but few will admit it > By Larry Greenemeier | June 25, 2015 > > > Stung: Law enforcement agencies sometimes use a device called a > stingray to simulate a cell phone tower, enabling them to gather > international mobile subscriber identity (IMSI), location and other > data from mobile phones connecting to them. Pictured here is an actual > cell tower in Palatine, Ill. > > > Given the amount of mobile phone traffic that cell phone towers > transmit, it is no wonder law enforcement agencies target these > devices as a rich source of data to aid their investigations. Standard > procedure involves getting a court order to obtain phone records from > a wireless carrier. When authorities cannot or do not want to go that > route, they can set up a simulated cell phone tower—often called a > stingray—that surreptitiously gathers information from the suspects in > question as well as any other mobile device in the area. > > These simulated cell sites—which collect international mobile > subscriber identity (IMSI), location and other data from mobile phones > connecting to them—have become a source of controversy for a number of > reasons. National and local law enforcement agencies closely guard > details about the technology’s use, with much of what is known about > stingrays revealed through court documents and other paperwork made > public via Freedom of Information Act (FOIA) requests. > > One such document recently revealed that the Baltimore Police > Department has used a cell site simulator 4,300 times since 2007 and > signed a nondisclosure agreement with the FBI that instructed > prosecutors to drop cases rather than reveal the department’s use of > the stingray. Other records indicate law enforcement agencies have > used the technology hundreds of times without a search warrant, > instead relying on a much more generic court order known as a pen > register and trap and trace order. Last year Harris Corp., the > Melbourne, Fla., company that makes the majority of cell site > simulators, went so far as to petition the Federal Communications > Commission to block a FOIA request for user manuals for some of the > company’s products. > > The secretive nature of stingray use has begun to backfire on law > enforcement, however, with states beginning to pass laws that require > police to obtain a warrant before they can set up a fake cell phone > tower for surveillance. Virginia, Minnesota, Utah and Washington State > now have laws regulating stingray use, with California and Texas > considering similar measures. Proposed federal legislation to prevent > the government from tracking people’s cell phone or GPS location > without a warrant could also include stingray technology. > > Scientific American recently spoke with Brian Owsley, an assistant > professor of law at the University of North Texas Dallas College of > Law, about the legal issues and privacy implications surrounding the > use of a stingray to indiscriminately collect mobile phone data. Given > the invasive nature of the technology and scarcity of laws governing > its use, Owsley, a former U.S. magistrate judge in Texas, says the > lack of reliable information documenting the technology’s use is > particularly troubling. > > > [An edited transcript of the interview follows.] > > When and why did law enforcement agencies begin using international > cell site simulators to intercept mobile phone traffic and track > movement of mobile phone users? > > Initially, intelligence agencies—CIA and the like—couldn’t get local > or national telecommunications companies in other countries to > cooperate with U.S. surveillance operations against nationals in those > countries. To fill that void companies like the Harris Corp. started > creating cell site simulators for these agencies to use. Once Harris > saturated the intelligence and military markets [with] their products, > they turned to federal agencies operating in the U.S. So the [Drug > Enforcement Administration], Homeland Security, FBI and others started > having their own simulated cell sites to use for surveillance. > Eventually this trickled down further to yet another untapped market: > state and local law enforcement. That’s where we are today in terms of > the proliferation of this technology. > > > Under what circumstances do U.S. law enforcement agencies use cell > site simulators and related technology? > > There are three examples of how law enforcement typically use > stingrays for surveillance: First, law enforcement officials may use > the cell site simulator with the known cell phone number of a targeted > individual in order to determine that individual's location. For > example, officials are searching for a fugitive and have a cell phone > number that they believe the individual is using. They may operate a > stingray near areas where they believe that the individual may be, > such as a relative's home. > > Second, law enforcement officials may use the stingray to target a > specific individual who is using a cell phone, but these officials do > not know the cell phone number. They follow the targeted individual > from a site to various other locations over a certain time period. At > each new location, they activate the stingray and capture the cell > phone data for all of the nearby cell phones. After they have captured > the data at a number of sites they can analyze the data to determine > the cell phone or cell phones used by the targeted individual. This > approach captures the data of all nearby cell phones, including > countless cell phones of individuals unrelated to the criminal > investigation. > > Third, law enforcement officials have been known to operate stingray > at political rallies and protests. Using the stingray at these types > of events captures the cell phone data of everyone in attendance. > > > How does law enforcement get permission to perform this type of > surveillance? > > Federal law enforcement agencies typically get courts to approve use > of something like stingray through a pen register application [a pen > register is a device that records the numbers called from a particular > phone line]. With that type of application, essentially the government > says, we want this information. We think it’s going to be relevant to > an ongoing criminal investigation. As you can imagine, that’s a pretty > low bar for them to satisfy in the eyes of the court. Just about > anything could fit into that description. You don’t even have to show > that such an investigation would lead to an arrest or prosecution. Law > enforcement is telling the court, look, we’re in the middle of this > investigation. If we get this information, we think it might lead to > some other important information. > > Different court orders have different standards for approval. The > highest standard would be for a wiretap. A search warrant likewise has > a much higher standard than a pen register, requiring law enforcement > to prove probable cause before a judge will grant permission to use > additional means of investigation. The problem that I have with a pen > register to justify use of something like a stingray is that the > standard for a pen register is much too low, given the invasive nature > of a pen register. Instead, I think the use of a stingray should be > consistent with the Fourth Amendment of the Constitution and pursuant > to a search warrant. > > > Why not explicitly state the type of technology being used and its > specific purpose when filing for a court order? > > [When] law enforcement agencies seek to obtain judicial authorization > through a pen register, they do not directly indicate that they are > applying for authorization to use a stingray. Doing so might cause > some courts to question whether the pen register statute [as opposed > to some higher standard] is the appropriate basis for authorizing a > stingray. In addition, law enforcement agencies typically have to sign > nondisclosure agreements with Harris Corp. in order to receive the > federal Homeland Security funding needed to purchase the technology. > So there’s this concern, at least at the local law enforcement level, > about revealing any information about it because that would violate > the agreement with Harris and maybe subject them to losing the > equipment or some other consequences. > > > Why would law enforcement agencies sign a nondisclosure agreement with > a technology company? > > I’m not sure whether the agreements are being driven by the FBI or by > Harris, but these agreements seem to be getting less relevant insofar > as [there is less] need to keep the public unaware of the existence of > this technology. In the last three or so years there’s been a lot more > awareness about the technology and its use. When agencies were first > signing these agreements years ago, use of this technology wasn’t > widely known. Now you are getting situations where criminal defense > attorneys learn about stingray and similar technologies and the role > they may be playing in the arrests of some of their clients. Defense > teams are starting to ask questions and require the government to > produce documentation such as court orders, and that’s creating the > confrontation you’re now seeing. > > > Why have law enforcement agencies kept their use of cell site > simulators so secretive? > > Some of it is the cloudy legal issues surrounding the legitimate uses > of this technology. Law enforcement agencies will also argue that the > more information that’s available about this technology, the harder it > is for them to use these devices to fight crime. Yet there’s a growing > knowledge of this technology, and a serious criminal enterprise is > already aware of it. People are already using prepaid disposable > phones [sometimes referred to as “burner phones”] to some extent to > defeat this technology. Sophisticated criminals are aware that there’s > electronic surveillance out there in myriad ways, and so they’re going > to take precautions. From a technology perspective, it’s sort of a > cat-and-mouse game. There’s also a device that locates cell site > simulators, something referred to as an IMSI catcher. There’s an arms > race back and forth to get the best technology and to get the edge. > > > What does it say to you about the whole process that a prosecutor or a > law enforcement agency is willing to sacrifice a conviction in order > to keep their methods a secret? > > I think it’s a very odd approach. You are throwing away some > convictions or potential convictions for the sake of secrecy. But it’s > even harder to understand now that knowledge of the technology is > becoming so common. There have been documented cases in Baltimore and > Saint Louis where stingray has supposedly been used. The use of > stingray and related technologies is a roll of the dice in the sense > that law enforcement is hoping that either the defense attorneys don’t > have enough savvy or wherewithal to find out about the technology and > ask the right questions or, even if that does happen, they’re hoping > that the judge that they have is favorable to their approach and not > going to order them to reveal information about its use. In the rare > occasions when things go against them, they just dismiss it. > > > You yourself denied a law enforcement application three years ago to > use a stingray. Under what circumstances would you approve its use? > > I want to make clear: I don’t have a problem with stingray itself—I > understand that this can be a valuable tool in law enforcement’s > arsenal. My problem is that I want it to be used pursuant to a high > standard of proof that it’s needed, and that I want the approval > process to be more transparent. One of the reasons I’d like to see > some more documentation of stingray applications and orders is because > I have this suspicion—but there’s no way of confirming it one way or > another—that some judges are signing approvals to use this technology > thinking that they’re just signing a pen register. If a judge thinks > it’s [just] another pen register application, they’re just going to > sign it without giving it much pause. > > > Now that the use of this stingrays and related technologies has been > made public, where will this issue be a year or a few years from now? > > A year from now I think we’re in the same position. You’re dealing > with outdated statutes concerning new and very different technology. > It’s possible in five years maybe that Congress will step in and do > something. More likely, state legislatures will take most of the > action to monitor this type of surveillance. Washington State, > California [and others] have already acted, and Texas is evaluating > the standards for approving stingray use. >

11 83

Possible crypto backdoor in RFC-2631 Diffie-Hellman Key Agreement Method
by Georgi Guninski 18 Feb '16

18 Feb '16

Possible crypto backdoor in RFC-2631 Diffie-Hellman Key Agreement Method I am n00b at crypto so this might not make any sense. In DH, if one can select group parameters (g,q,p) he can break both parties private very fast time IMHO. The RFC: https://tools.ietf.org/html/rfc2631 The main problem appears: https://tools.ietf.org/html/rfc2631#section-2.2.2 2.2.2. Group Parameter Validation The ASN.1 for DH keys in [PKIX] includes elements j and validation- Parms which MAY be used by recipients of a key to verify that the group parameters were correctly generated. Two checks are possible: 1. Verify that p=qj + 1. This demonstrates that the parameters meet the X9.42 parameter criteria. 2. Verify that when the p,q generation procedure of [FIPS-186] Appendix 2 is followed with seed 'seed', that p is found when 'counter' = pgenCounter. The main problem appears MAY. As I read it, implementation MAY NOT verify it. Sketch of the attack: Chose $q$ product of small primes $p_i$. Solve the discrete logarithm modulo $p_i$ for the public keys. Apply the Chinese remainder theorem to get the privates keys. (This is well known method for DL and for this reason the group order must be prime [160 bits ;)]). Would be interested how implementations implement this MAY. Let me know if there is better list for this. -- georgi

4 44

request for comment re "contributor-covenant.org"
by Zenaan Harkness 12 Feb '16

12 Feb '16

Hi cp-ers, On the PostgreSQL database mailing list pgsql-general(a)postgresql.org , they are discussing a Code of Conduct. A reference and discussion came up around contributor-covenant.org and it seems many (allegedly 1000's of "open source projects" have "adopted" it, and there appears to quite the campaign to "encourage" the PostgreSQL project to likewise adopt that particular agreement. The pgsql old hands appear to have rejected it. This is a rare thing AFAICT. There are a few issues raised about the so-called "contributor covenant" which have very clearly, and repeatedly, not been responded to, and this has been pointed out, more than once. Those who chaperone one or more "open source" project mailing lists may wish to bring themselves up to speed with this so-called "covenant" before the steamroller hits your group/ list/ community, since it seems inevitable at this point. Being riveted and enraptured by concepts of "enforcement", "protection" of "the marginalized peoples" and as y'all know, my raving crusade to further promote "political correctness", I figured I should go and read this "covenant" to find out what all the fuss might be about and add some scare quotes at appropriate places. So I went and read it. It simply, abso-firetruckingly, demands a response, and beyond what appears to have currently been tippy toe on eggshells burped out so far. Here is my first draft to respond to it, I encourage others to refine my oh-so-subtle analysis, but most importantly to bring yourself up to speed with the PC-speak which might freight train into one or more of your "open source" worlds in the relatively near future; informed ahead of time may be enough to be armed against long and actually divisive email discussions, as internet searching sadly tells. The below is my second woeful attempt to bring some sanity to that "covenant". It needs your improvements. Good luck, Zenaan ---- http://contributor-covenant.org/ >> Contributor Covenant >> A Code of Conduct for Open Source Projects. Sounds reasonable. >> Open Source has always been a foundation of the Internet, and with the advent >> of social open source networks this is more true than ever. Let's hope free libre and open source software - FLOSS, stays as the foundation of the Internet! "social open source networks" - what?? Facebook social network?? Use of new terminology, without explaining that terminology, and presuming it is known and well understood terminology, in a document you are pushing as a new and additional "social contract" which others are pressed upon to adopt and enforce, is IMHO passive aggressive. >> But free, libre, and open source projects suffer from a startling lack of >> diversity, with dramatically low participation by women, people of color, and >> other marginalized populations. Those who have an interest in promoting, assisting, sponsoring and generally facilitating "the diversity" within this particular libre software project or mailing list, are welcome to do so and in general, ought be supported to the extent that their actions and words are neither actively nor passively aggressive towards any member of this mailing list, and are actually supportive of the technical goals of this project. >> Part of this problem Lack of diversity may be viewed as a problem. Such a viewpoint is a personal, individual matter. Your personal, individual opinion on this matter may be discussed, but in general is off topic for this mailing list. Speaking or writing that "lack of diversity is a problem", and even moreso, building the presumption into the words of a so-called "social covenant", where that presumption is almost hidden and "not up for debate", is a passive aggressive approach to communication with others who may or may not disagree with this position. Passive aggressive communication is not welcome on this mailing list. >> lies with the very structure of some projects: What is "the very structure of a project"? This phrase is too generic, and not explained, despite the next part of that sentence which follows below, which appears to pretend to answer (or define) the phrase - it does not. Phrases and terminologies used out of context and having indefinite and vague meanings, is a sign of passive aggressive communication and all members of this mailing list are encourage to ridicule such communication. >> the use of insensitive language, thoughtless use of pronouns, assumptions of >> gender, and even sexualized or culturally insensitive names. Although certain social niceties are encouraged on this mailing list, they are not required and indeed firm, clear and precise languaging is valued and encouraged. If you are overly sensitive, or in need (or desire) of an emotionally sensitive environment, then consider another mailing list - this mailing list is likely not for you, and if you are in need of any professional help, you are encouraged and indeed required to seek professional medical and or psychological advice and or support. >> Marginalized people also suffer some of the unintended consequences of >> dogmatic insistence on meritocratic principles of governance. There are forums and mailing lists which are suitable for those who have learning difficulties (reference?), for those who need an emotionally sensitive environment (be sure to check if you need professional medical or psychological support), and for those who are beginniners in the field of technology discussed on this mailing list. In all of these cases, this mailing list is not for you, and you will be encouraged to leave if we discover that any of these conditions apply to you. Take note, we heartily welcome the opportunity to joust against your best attempts to otherwise deceive us in regards to such conditions applying to you, although in general in such cases, please expect derision and ridicule for wasting our time in such circumstances. >> Studies have shown that organizational cultures that value meritocracy often >> result in greater inequality. This is a baseless assertion. Provide the references or go away. Such an unsupported, unreferenced and 'plastic' attempt to dominate our community into conforming, acting and behaving according to your standards is unwelcome in the extreme, and grounds for the ridicule of you. In any case, this mailing list is for those who have a minimum intermediate skill and understanding in the programming languages and technologies for which it has been established, and is explicitly not for those who are overly sensitive and need an emotionally supportive environment - we might have a laugh, and it may be at your expense, so if you can't laugh at yourself, this mailing list is definitely not for you. >> People with "merit" are often excused for their bad behavior in public spaces >> based on the value of their technical contributions. You may join this mailing list, but by doing so you agree to speak clearly and assertively if you feel offended, or otherwise to respectfully leave the mailing list, as it is unmoderated and uncensored, although discussion is generally sought to be on topic, and for offtopic digressions to be kept short and taken offlist or to an alternate list if they persist. Additionally, your consideration that this mailing list is a public space, is only partially correct. This mailing list is a list which is open to conditional membership, and the list administrator reserves the right to ban you temporarily and or permanently at any time, but with prior notice and opportunity for discussion given on this mailing list. Take Notice further that the discussions had by members of this mailing list are archived publicly, so to this extent the list may be considered public, whilst it is strictly a members only mailing list who choose to have certain public discussions, which may include attempting to ridicule -you-, so obtain a temporary membership to this email mailing list only after very careful consideration by you. If you are at all unsure of your suitability to our list, we are happy to help you decide by analysing your proposed introduction email of yourself. >> Meritocracy also naively assumes a level playing field, in which everyone has >> access to the same resources, free time, and common life experiences to draw >> upon. The sentence above is another passive-aggressive, presumption filled projected assertion. Such communication has no place on this mailing list, except as the target of naming the presumptions, highlighting the passive aggressive nature and generally tearing it to shreads and providing an opportunity for the mailing list members to laugh like hyenas. - >> "Meritocracy naively assumes" Meritocracy does no such thing - it is not a person. - >> "Meritocracy also naively assumes a level playing field," Meritocracy does no such thing - in fact it is the opposite - meritocracy is a socio political agreement, contract and or requirement that participants in the system shall be judged based on their technical merit and or performance. In our case, slow performance is entirely acceptable, you are under no requirement nor expectation to make contributions according to any schedule, only on your own free time and personal pleasure. Making any assertion to the contrary is passive aggressive, manipulative, and shall be joyously and most light heartedly attacked in words. - >> "in which everyone has access to the same resources, free time," No such assumptions are made on this mailing list, and quite the contrary - if you have very little free time for example, or a slow computer, then we will certainly expect that your contributions may be few and far between as compared with someone who has loads of free time or a faster computer than you. If you are experiencing free time and resources problems, then this list is DEFINITELY not the place for you - you are explicitly instructed to seek professional time management advice as well as professional financial counselling. DO NOT bring such personal problems to this mailing list, as they will be used as instant grounds for removal and for barring from the list, although more likely simply as grounds for ridicule and laughing like hyenas. - >> "and common life experiences to draw upon." Once again, "meritocracy" (to the extent we can personify a socio political system), and "we" the members of this mailing list in particular, make no such assumptions whatsoever, and we more importantly, put no such requirements upon you. So sleep tight, it's all alright, we won't hold your differing life experiences against you, in fact we may be intrigued, but if a particular experience you share starts to cause an extended off topic discussion, take notice that we reserve the right to calmly let you know this so that we can get back to the topics intended for this mailing list. This list may be a platform, but at most only for those robust enough to hold their own on the topic they make a post about. If you join this mailing list, you are strongly encouraged to communicate your personal concerns and problems, needs and requirements at the earliest stage possible, preferably in in your introduction email with a well identified subject line. Then we will be able to readily assess whether this mailing list is suitable for you or whether you need to find another, more appropriate environment in which to express yourself and or to find a "contribution space" which is suitable for your needs. If you are unsure, then you are welcome to introduce yourself in this way, and we will respectfully assess your suitability to the mailing list as best we can. Take notice that we are not professionals in any field, indeed we are amateurs that might be in your personal medical or other interests to NOT associate with, and that if you require any professional advice, medical or otherwise, then you are required to seek such advice from suitably certificated professionals in your area - we on this mailing list cannot help you in such circumstances and if you fail to inform us of any such problems and or issues you may have that you consider we would otherwise be responsible for, then you may be in breech of the legislation in your jurisdiction - deceive the members of this mailing list at your own legal liability. On this mailing list, robust communication is a prime valued contribution - if you are actively wanting to improve your emotional robustness, this mailing list could possibly be a suitable place for you - feel free to ask us about this specifically in relation to you. >> These factors and more make contributing to open >> source a daunting prospect for many people, If your emotional strength, your social and or communication capacity, and or your psychological needs are an issue in any way, you are not welcome on this mailing list and we require you to seek professional medical advice. >> especially women and other underrepresented people. (For more critical >> analysis of meritocracy, refer to this entry on the Geek Feminism wiki.) If you have any trigger words, emotional weaknesses and or sensitivities which may cause you to have any reaction whatsoever, you are required to inform the members of this mailing list in an introduction email if you do join the list, and if you are required to do so, you must seek professional medical and or psychological advice and support - this mailing list is most likely an inappropriate place for you to join, and we continue to encourage ourselves to not hold back in reminding you this. >> A Small Step Forward >> An easy way to begin addressing this problem You may have some problem, and this mailing list not the place for you to fix your problem. Only technical matters related to the technical topic of this mailing list are appropriate problems for fixing in discussions on this mailing list. Seek professional advice when you need it, including professional advice regarding the technical topic of this mailing list if that is what you require - this mailing list is for non professionals with at least moderate technical competence, all members are volunteers, all members participate at their own discretion and with no obligations upon them and with no obligations whatsoever to you, including courtesy which is valued, but not required - enter at your own risk. >> is to be overt in our openness, welcoming all people to contribute, and >> pledging in return to value them as human beings and to foster an atmosphere >> of kindness, cooperation, and understanding. This we agree with - we, the members of this mailing list, proclaim our intention to welcome all people to contribute, and to value each member as a human being. We encourage each other to foster an atmosphere of kindness, cooperation and understanding, and robustness in communication - passive aggressive communication, despite the best intentions of the one making such passive aggressive communication, has no place in our community. And take notice - persistent bad behaviour, 'bad' by the assessment of the members alone and discussed publicly on this mailing list, shall be cause for temporary and or permanent banning from this mailing list. >> The Contributor Covenant can be one way to express these values. Pledge your >> respect and appreciation for contributors and participants in your open >> source project by adding an explicit CODE_OF_CONDUCT.md to your project >> repository. Respect, kindness and cooperation are good things, but this "http://contributor-covenant.org/" "contributor covenant" to which we hereby respond, is in no way or shape getting into our project's repository without this our response. >> The Contributor Covenant uses semantic versioning for revisions so all URLs >> are permanent. Previous versions are available here: 1.0, 1.1, and 1.2 >> Using the Contributor Covenant >> We recommend that you add the Markdown or text version of the Contributor >> Covenant to your source code repository at the root level. >> Thanks to Simon Vansintjan there is an automated way to add Contributor >> Covenant to your project. Assuming that you have node installed, simply run >> the following two commands from your project folder: >> npm install -g covgen >> covgen your_email_address >> You may want to add language similar to this to introduce your code of conduct: >> Please note that this project is released with a Contributor Code of >> Conduct. By participating in this project you agree to abide by its >> terms. >> You may also use the permalinks given above to reference from your project >> home page. >> Important! You must add a contact method to the placeholder in the document >> so that people know how to report violations. Enforcing the Contributor >> Covenant This above paragraph does not quite feel right. If the members of this mailing list are so anti-social that genuine "social problems" cannot be resolved on the mailing list itself, then this "community" of members is quite likely beyond repair without substantial work by robust individuals with a passion to heal the community - if you are not such an individual, then you best leave that job to comeone who is, and take yourself to a kinder, gentler happy place. >> Do not simply add the Contributor Covenant to your project and assume that >> any problems with civility, harassment, or discrimination will be solved. As >> a project maintainer you must be committed to enforcing the code of conduct. There may be a time and place for banning members from this mailing list, temporarily and or permanently, but such discussions shall continue to be public, on the mailing list itself and open to discussion and contribution by all members. No duty is incumbent upon any member, including the "project maintainer" - if the community can't work out its problems, it is unfair to place such a burden upon such a one individual. >> A code of conduct without enforcement sends a false signal that your project >> is welcoming and inclusive, and can create a dangerous situation for >> marginalized people who participate. "Marginalized people" who are not competent to contribute on some technical level (which includes documentation writing, testing as well as programming), are not welcome - we the members of this mailing list are volunteers and, on this particular mailing list, are not willing to tutor those who have special needs - do not join the mailing list in such circumstances, there are other, appropriate forums, mailing lists and learning institutions which you ought apply to. Genuinely anti-social communication is actively discouraged, and this includes those who communicate deceptively regarding their own needs and or social environment requirements, as well as those who communicate in a passive aggressive way. If you this any of these types of communication may apply to you, then be prepared to suffer the consequences should you join this mailing list - we shall roast you in words, with glee! >> Adding the Contributor Covenant to a project places responsibility on the >> project team that must not be taken lightly. Since the archives of this mailing list are public, should you have even the smallest concern regarding your own robustness in public communication, then you are invited to browse those archives and make an assessment as to whether you are a suitable candidate to join this mailing list. If you do decide to join, you are required to make your first email an introduction, which introduction includes a reference to your assessment of the archives as well as any needs you feel that the members of this list ought be able to meet. >> Before adopting the Contributor Covenant take the time to discuss and decide >> how to deal with problems as they emerge. Document the policy and procedure Oh, we've taken the time, and "problems as they emerge" shall be handled publicly, on this mailing list! To the extent we the members of this maliing list consider you a problem, passive aggressive or otherwise, we WILL handle you, publicly, with the one caveat that all members are in general expected to show respectful consideration in respect of all private or "off-list" communications. If you are uncomfortable with this policy, you are encouraged to find a more suitable community to join. >> for enforcement, and add it to your README or in another visible, appropriate >> place. Consider if your project team has the willingness and maturity to >> follow through on your enforcement procedures. A "community" that requires any significant policing, particularly clandestine policing, has lost its way - the tyranny of the majority is not the healthiest way, in the opinion of some members - speak clearly, speak the truth, and seek a fair response; if you don't receive a fair response, another community might be much less work for you, even if it provides less opportunities for emotional growth for you.

12 19

Cryptsy theft->bankruptcy
by dan＠geer.org 12 Feb '16

12 Feb '16

...You probably want to see the article (jpegs of relevance)... www.databreachtoday.com/bitcoin-heist-steals-millions-from-exchange-a-8803 Cryptsy Faces Potential Bankruptcy Over Just-Revealed 2014 Hack Mathew J. Schwartz (euroinfosec) o January 15, 2016 Bitcoin Heist Steals Millions from Exchange Cryptocurrency exchange Cryptsy, which trades bitcoins as well as more than 100 types of "altcoins" such as litecoin and namecoin, disclosed Jan. 15 that it was robbed in 2014. As a result of the breach, the exchange has now suspended all trades and says it will file for bankruptcy unless the stolen bitcoins are returned. Florida-based Cryptsy says the attacker stole 13,000 bitcoins, worth $5 million today, as well as 300,000 litecoins, worth $970,000 today. The exchange says the theft was not related to the recent phishing and distributed denial-of-service attacks that it's suffered. It suspects that the most recent developer behind Lucky7Coin - LK7 - is the culprit behind the attacks, based on a backdoor that it found inside its network. "About a year and a half ago, we were alerted ... a reduction in our safe/cold wallet balances of bitcoin and litecoin, as well as a couple other smaller cryptocurrencies," Cryptsy says in a blog post. It says its investigation ultimately found that the developer of the Lucky7Coin cryptocurrency "had placed an IRC backdoor into the code of wallet, which allowed it to act as a sort of a Trojan, or command-and-control unit." The exchange adds: "This Trojan had likely been there for months before it was able to collect enough information to perform the attack," which was executed on July 29, 2014. A user of code-sharing site GitHub in March 2015 detailed that apparent backdoor in the Lucky7Coin IRC code, noting that it would give an attacker "the ability to run arbitrary commands on the victim's host." Cryptsy suspects that whoever originally developed Lucky7Coin isn't responsible for the backdoor, but rather someone named "Jack," who claimed to have taken over development of the cryptocurrency codebase and related code, and who contacted Cryptsy on May 22, 2014. "You're the only exchange for this coin and I hope you will let me take care of it. I'm responsible," Jack claimed. Message From New Lucky7Coin Developer [Cryptsy-720.jpg] Cryptsy says it fell for a Trojan attack initiated by "Jack." Connection to Jailed 'Silk Road' Secret Service Agent Cryptsy is not the first exchange to have faced insolvency after hackers stole its bitcoins (see Bitcoin Exchange Hacked With Word Macro). But why didn't the exchange come forward sooner? Officials at Cryptsy couldn't be immediately reached for comment. But in the blog post, Cryptsy says it initially tried to cover the missing funds using its exchange profits and appears to suggest that everyone would have been worse off, had it gone to authorities, because its U.S. Secret Service contact was none other than Special Agent Shaun Bridges. "I think we all know what happened with him," the Cryptsy blog post notes. In August, Bridges pleaded guilty to both money laundering and obstruction of justice. He was accused of abusing his position while a member of the Secret Service's Electronic Crimes Task Force that was investigating the notorious darknet narcotics marketplace called Silk Road (see Former Secret Service Agent Pleads Guilty to $800K Bitcoin Theft). Cryptsy, which is a member of the Financial Crimes Enforcement Network, also says it attempted to contact the FBI Miami field office recently, but was redirected to the Internet Crime Complaint Center. IC3, as it's also known, is run by the FBI, the National White Collar Crime Center and the U.S. Bureau of Justice Assistance; it deals with Internet crime complaints (see Hackers Claim FBI Information-Sharing Portal Breached). The exchange says it has yet to hear back from IC3. Will Missing Bitcoins Come Home? Cryptocurrency news site CoinDesk reports that declining trading volumes have undercut the exchange's profits and that the exchange has halted trading twice in the past two weeks, blaming one of those outages on a phishing attack that employed users' email addresses and phone numbers. But a class-action lawsuit filed Jan. 13 against Project Investors - doing business as Cryptsy - and Paul Vernon, who it says is the founder, operator, and CEO of Cryptsy, alleges that since November 2015, "certain Cryptsy users started having difficulties and inabilities withdrawing any and all forms of currency from their accounts." The plaintiff, Virginia-based Jinyao Liu, "seeks damages based upon the unlawful conduct of defendants in denying account holders the ability to obtain funds in their accounts and in misappropriating funds held in the Cryptsy accounts," according to the lawsuit. Thank you everyone for the patience while we get these issues resolved. Team is working hard and we will try to do more frequent updates. BigVern (@cryptsy) December 10, 2015 In its Jan. 15 blog post, Cryptsy says it now faces a 10,000 bitcoin ($3.8 million) shortfall and identifies three available business options: It shutters the website and files for bankruptcy; someone purchases the exchange and makes good on the requested withdrawals; or the attacker returns the stolen bitcoins - no questions asked. While that might sound far-fetched, Cryptsy says that after the July 29, 2014, theft, based on the bitcoin wallet address tied to the theft, "those bitcoins have not moved once since this happened" which "gives rise to the possibility they can be recovered." To help, Cryptsy has offered a reward of 1,000 bitcoins ($380,000) for "information which leads to the recovery of the stolen coins." Bye-Bye, Litecoins Cryptsy doesn't reference the fate of the missing litecoins. But they appear to have been cashed out: On July 2, 2014, someone dumped exactly 300,000 litecoins - quite a coincidence - onto an exchange all at once, which was such a large volume of coins that it temporarily drove down the price of each individual litecoin from $8.50 to just $2. As noted on a related Reddit conversation: "The volume was so high that he basically chewed through the entire buy side of the order book, all the way down to someone who had (probably on a lark) put in a buy order at $2," reports Reddit user FreeJack2k2. "After clearing out the ask side of the order book, the new sell orders only dropped to the low $7 range (the recovery from $2 was immediate) and eventually got bought back to where we are now, at around $8. Whoever had that $2 buy order in the books made out like a bandit."

2 1

Self Preservation and Irreversible Decline [was: Electronic Freedom Foundation selective in support of freedom]
by coderman 11 Feb '16

11 Feb '16

On 1/6/16, Sean Lynch <seanl(a)literati.org> wrote: > ... I've found myself self-censoring quite a lot more > since my kids were born. this topic has been on my mind recently, "You know, It would be a lot easier you just didn't do X" "This wouldn't happen if you quit annoying Y" "If you accept, Z will pay nicely and protect you." where X is FOIA requests, security research, PET development, etc., Y is some powerful entity like FBI, NSA, Verizon, Intel, etc., and Z is some convenient but forever bound by position requiring a clearance and suspension of moral qualms. when you've got the world to loose (nothing more encompassing than your own family!) preservation is near irresistible. simple fear of harm might be compelling enough for the majority to cower compliant, even. --- when i was young, these questions of "do i do right? or do i stay safe?" were abstract and applicable only to foreign backwaters or past history. a modern, free liberal democracy need never exercise such restraint - we have Blind Justice which always finds in favor of the righteous! over some years i lost this innocent faith in perfect justice, saw abuses of power against the less fortunate or less familiar, accrued things dear to me like friends and new family, and became comfortable in a lifestyle with all needs met. . . . now USA in a state of perpetual war, executive power at record levels, surveillance staggering in breadth and invasiveness, censorship and suppression of speech creeping ever further into the centralized systems dominating over our way of life, it's not good... and yet we're not rounding up foreign-born citizens and their families for incarceration at detention camps (like Japanese during the war). not to mention that much of the rest of the world would be killed or imprisoned leading my kind of life in another jurisdiction! when people are being killed for exposing corruption or injustice, it seems ridiculous to complain about annoyances resulting from optional activities i have chosen to undertake willingly - not out of dire need or coercion. with all my needs still met. --- all of which made me wonder, what did the every day German or Italian citizen see before fascism ravaged sanity? what did they see that felt disturbing, but not overtly threating and could be ignored? what did they see which told them all legitimacy was lost and only resistance remained? the #YallQueda rebellion staged their last stand in my state, with land use abuse the straw upon their broken backs. perhaps loss of livelihood a better Rubicon? --- then another "If you quit doing that, it would all be much easier..." was said, and i wondered if this was the key sign of trouble i was fearing to see. when lawful activities performed for the good of the public draw unjustified scrutiny and disruption from the state, has the state itself become corrupt? how far must this corruption spread before it cannot be stopped without destruction of the state, no matter the size and vehemency of public protest? can the tools of technology and manufactured consent provide the state ability to become completely corrupted without detection, nor resistance from the public? --- i don't know the answers, and i am curious to hear opinions. i still live a rich life with needs met and i don't think we're on the brink of a fascist nightmare future. maybe hell on earth is closer than i think... thoughts? best regards, NOTE: i am using the terms fascist and fascism explicitly, not capriciously. ''' Fascism is a form of radical authoritarian nationalism that came to prominence in early 20th-century Europe... Fascists saw World War I as a revolution that brought massive changes in the nature of war, society, the state, and technology. The advent of total war and total mass mobilization of society had broken down the distinction between civilian and combatant. A "military citizenship" arose in which all citizens were involved with the military in some manner during the war. The war had resulted in the rise of a powerful state capable of mobilizing millions of people to serve on the front lines and providing economic production and logistics to support them, as well as having unprecedented authority to intervene in the lives of citizens. Fascists view World War I as having made liberal democracy obsolete, and regard total mobilization of society under a totalitarian one-party state as necessary to prepare a nation for armed conflict and to respond effectively to economic difficulties. Such a state is led by a strong leader — such as a dictator and a martial government composed of the members of the governing fascist party — to forge national unity and maintain a stable and orderly society. Fascism rejects assertions that violence is automatically negative in nature, and views political violence, war, and imperialism as means that can achieve national rejuvenation. ''' - https://en.wikipedia.org/wiki/Fascism

12 38

USA To Require Govt Issued ID To Use Internet, No More Anonymous
by grarpamp 10 Feb '16

10 Feb '16

http://yro.slashdot.org/story/16/01/20/1321243/senior-homeland-security-off… A senior Homeland Security official recently argued that Internet anonymity should outlawed in the same way that driving a car without a license plate is against the law. "When a person drives a car on a highway, he or she agrees to display a license plate," Erik Barnett, an assistant deputy director at U.S. Immigration and Customs Enforcement and attache to the European Union at the Department of Homeland Security, wrote. "The license plate's identifiers are ignored most of the time by law enforcement. Law enforcement will use the identifiers, though, to determine the driver's identity if the car is involved in a legal infraction or otherwise becomes a matter of public interest. Similarly, should not every individual be required to display a 'license plate' on the digital super-highway?"

10 71

Cicada 3301: 2016
by grarpamp 08 Feb '16

08 Feb '16

https://twitter.com/1231507051321/ https://en.wikipedia.org/wiki/Cicada_3301 http://uncovering-cicada.wikia.com/

3 2

Re: request for comment re "contributor-covenant.org"
by shakeitoff＠ghostmail.com 05 Feb '16

05 Feb '16

>> Genuinely anti-social communication is actively discouraged, and this includes >> those who communicate deceptively regarding their own needs and or social >>environment requirements, as well as those who communicate in a passive >> aggressive way. If you this any of these types of communication may apply to >> you, then be prepared to suffer the consequences should you join this mailing >> list- we shall roast you in words, with glee! Why doesn't the gleeful roasting extend to the bigotry and chauvinism on this list? Why are these silently accepted? Cypherpunks defines government as “a home for bullies masquerading as a collective defense.” Interestingly, that is how I would describe your above approach. Be careful of becoming the oppressor. Look around. Do the people around you look like you? Think like you? Come from the same background as you? This is a problem. The lack of diversity in this group is not a magical phenomenon without a root cause. There is a deeper problem. If (and how) this should change is up to this community. Sadly, the ideals of this community are often lost in the (typically incoherent) bigotry spewing from the trolls. 4.12.4. "Crypto Anarchy sounds too wild for me." - I accept that many people will find the implications of crypto anarchy (which follows in turn from the existence of strong cryptography, via the Crypto Anarchy Principle) to be more than they can accept. - This is OK (not that you need my OK!). The house of Cypherpunks has many rooms. All are welcome. I hope. >> There are forums and mailing lists which are suitable for those who have >> learning difficulties (reference?), for those who need an emotionally sensitive >> environment (be sure to check if you need professional medical or >> psychological support), and for those who are beginniners in the field of >> technology discussed on this mailing list. Wow. How fucking elitist can you be? Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

7 6

Re: request for comment re &quot;contributor-covenant.org&quot;
by shakeitoff＠ghostmail.com 05 Feb '16

05 Feb '16

>> Cypherpunks defines government as “a home for bullies masquerading as a >> collective defense.” Interestingly, that is how I would describe your above >> approach. > These two sentences are approaching incoherent. Would you like to try > again? It is probably not constructive for me to respond to > incoherence - there is perhaps some truth or pain or seeking which has > not been expressed clearly, which I would hope you feel confident > about expressing, or re- attempting to express - such is in our > collective interests. The main worry is when “gleeful roasting” slips into bullying and irreversible harm. It's easy for a collective group to shout someone out for the wrong reasons. Censorship is not the answer to this. But having plain, honest, thoughtful conversations might be. >> Look around. Do the people around you look like you? Think like you? Come >> from the same background as you? > >> This is a problem. > So say you. > Making you assertion is presently an island waiting for supporters - > nothing more than a political position in search of part members. This > is not the place for such superficiality. I personally seek deeper > conversation. If you create an environment that is conducive to only one socioeconomic class, you lose individuals who are strong technologists, but whom don’t fit a certain race/gender/economic profile. It is a loss for the community when strong technologists leave because they do not fit the socioeconomic culture of the majority. Especially when considering what this group is fundamentally trying to resist. >From my own personal experience- when a group is diverse, one’s own race/gender/economic background matters less and fades into the background. This is the ideal- to not even have to talk/think about socioeconomic issues, and focus on common issues- on how to reverse the end of privacy, on writing code, on ensuring strong cryptography. > Do you assert that you would like a particular communication space to > exist, which does not currently exist, but which is somehow similar to > cypherpunks mailing list, but perhaps a little different? No, there is nothing begrudging. I’m here because I want to be useful to ensure that privacy and personal liberty and privacy continue to exist. And to learn. This is the ask: don’t let this be a space where someone has to struggle between alignment to the cypherpunks ideology (writing code, ensuring privacy and liberty, preserving cryptography) and alienation because of one’s socioeconomic background. Also, let us not forget who the real enemy is. Thank you. Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

4 5