September 2016 - cypherpunks - lists.cpunks.org

Re: Continual Violation of List Charter
by Mark Steward 05 Sep '16

05 Sep '16

On 4 Sep 2016 22:13, "juan" <juan.g71(a)gmail.com> wrote: > ... > > > "Form your own group, your own mailing list, with a catchy > > > name, something like "The Privacy Education Foundation," or > > > "The American Civil Liberties Union" (whoops, taken), or > > > "The Society for the Preservation of Cyberspatial Liberty." > > > " > > > "Evolution in action. The market in action. A better > > > approach than trying to get the name and the charter changed." > > > > A market in action... > > My point is that the CHARTER of the mailing list is supposed to > be LIBERTARIAN. > I don't think you have a clue what libertarian means. > > > I even found time to > > correct Tim May, who cried uncle sort of. ;-) I happened to have > > personal knowledge of that situation. > > > > I wasn't mature enough to philosophize much then. > > > And you think you are know? Do you know the etymology of the > word "philosophy", I suppose? > > Philo-sophy means love of knowdlege/wisdom. See, the requirement > for philosophy is not 'maturity'(whatever you mean by that). > The requirement for philosophy is the love of truth and > intellectual honesty. > I see you're authoritarian about language too. Philosophy's history, much like Scientology's, owes more to narcissism than etymology. Mark

3 2

Re: Open Public Notice re Tor Inc and Jacob Applebaum
by Ryan Carboni 04 Sep '16

04 Sep '16

The timeline of events will be fascinating to look as information drips out over time. In May, the Tor Project went from the FBI is harassing our developers, to Appelbaum is a rapist. Tor is showing it's age though, the 2013 botnet showed that Tor was less than optimal in it's design https://trac.torproject.org/projects/tor/ticket/9683 Of course making Tor more like nginx or Caddy would require a total rewrite, worker processes have the advantage of parallelization of crypto. One cannot expect their browser to be secure if it renders javascript, graphics, or media. QUIC uses the minimum of public headers and does not retransmit the same packet number, would allow for a packet switched design. Of course, the cheapest way to defeat Tor would be to DDOS it. How much would it cost to have several thousand of VPSes connect to each other over Tor and download /dev/zero/ to /dev/null/? Sometimes the best route is passivism.

1 0

Continual Violation of List Charter
by grarpamp 04 Sep '16

04 Sep '16

On Sat, Sep 3, 2016 at 4:38 AM, Zenaan Harkness <zen(a)freedbms.net> wrote: > shit and get down to business on analysing political philosphies, to > find practical approaches for our modern societies full of schooled This list is *not* for that, and it's not a list to longtalk food recipes, or anything else either. Lack of moderation is not license for people to come here and setup their own offtopic shops, grossly, willfully and continually disrespecting what it says on the tin and the history of the list long before you [1], to the tune of many tens to hundreds of messages per month, especially without tying it into that. If you want to longtalk anything other than that to the point that the charter would need a whole new section just for you, GO FIND OR MAKE YOUR OWN FUCKING LIST FOR THAT. [1] "The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society." There are reasonable relateds within the realm of "cypherpunk" to include *its* computing, tools, privacy, surveillance, law, news, literature / art / society, hacking / making, organizations and projects, politics, tech, science, solutions, crime, etc, etc. The occaisional short lived foray under self regulation and restraint into untied topics of possible interest to readerbase might be considered ok, however NOT to the extent that it's been abused ongoing. If you're wondering why the "thousands" of people on the list aren't "analysing political philosophies" with you, it's because YOU'RE FUCKING OFFTOPIC, THEY DON'T WANT TO, and they've BLOCKED YOUR ASS. But for new people hoping to find a real or even passable cypherpunk list, and before even joining and blocking you, but just looking over archives, your noise, and the angry abusive trolls, kills it for them. Have some respect for that. The lot of you. Or get off here.

13 32

The NSA’s stash of digital holes is a threat to everyone online
by Cecilia Tanaka 04 Sep '16

04 Sep '16

The NSA’s stash of digital holes is a threat to everyone online. < https://www.theguardian.com/commentisfree/2016/sep/04/nsa-stash-digital-hol… > -- "I disapprove of what you say, but I will defend to the death your right to say it."

2 2

[WAR] US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world”
by Zenaan Harkness 04 Sep '16

04 Sep '16

** Must see video: US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world” (http://theduran.com/must-see-video-us-peace-council-returns-syria-county-fi…) ------------------------------------------------------------ must-see-video-us-peace-council The campaign to confuse the American people has been intense, but one thing is sure, Syria is fighting an invasion, not a civil war. The post Must see video: US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world” (http://theduran.com/must-see-video-us-peace-council-returns-syria-county-fi…) appeared first on The Duran (http://theduran.com) .

1 0

4096 bit SSL keys
by John 04 Sep '16

04 Sep '16

Speaking within the context of https SSL certs, is there any real value to a key/cert above 2048 bits? The reason I asked: updating a few certs at office recently I nuked an older F5 LTM device by installing a 4096 bit key/cert pair - the load on the appliance (Linux based) shot up from less than 1 to about 30 and became so excruciatingly slow it was nearly impossible to back the change out (web GUI and ssh were both nearly non-responsive).. On modern hardware, including modern F5s, this problem doesn't exist... but from what reading I've done it seems 4096 buys you very little anyway ? With a theoretical quantum computer attacking is there any significant gain with the bigger key size? Curious what others think.... John -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

4 3

The Unsettling Relationship Between Russia and Wikileaks
by grarpamp 04 Sep '16

04 Sep '16

http://www.nytimes.com/2016/09/01/world/europe/wikileaks-julian-assange-rus… http://www.dailymail.co.uk/news/article-3769958/Does-Wikileaks-help-Russia-… Now, Mr. Assange and WikiLeaks are back in the spotlight, roiling the geopolitical landscape with new disclosures and a promise of more to come.

3 2

Playing with overlay networks
by Mirimir 04 Sep '16

04 Sep '16

So let's say that a bunch of us have Tor onion servers. They're linked to each other via OnionCat with ip4ip6 tunnels. With IPv4 routing so each can hit the others. And with iptables rules (IPv4 and IPv6) to drop packets to/from everyone else running OnionCat. Maybe even HiddenServiceAuthorizeClient/HidServAuth to lock down access. What might we do with that? We might create an overlay Internet, I suppose. Given how long OnionCat has been around, there are probably a few of those. I doubt that OnionScan[0,1] would see the connections, given that there are no hyperlinks, and better, no unauthorized access. But more specifically, what? BitTorrent, for sure ;) LizardFS works, so we could have private and shared cloud storage, backed by globally redundant, erasure-coded storage. What about VPN services? Say, with two VPS linked via OnionCat. You hit VPN server as an onion service, and exit through one of many redundant VPS. We already have <https://i2vpn.eu/>. So maybe chain that with VPNs via onion services. What do y'all think? And what about Freenet or I2P on an OnionCat network? Or one of the P2P messaging apps? Or even old-school Mixmaster? Back to basics, would any of that help against global adversaries? It's very hard to evade observation of network edges. You can have lots of chaff, but then that itself can be a signature. [0] https://github.com/s-rah/onionscan [1] https://motherboard.vice.com/read/these-maps-show-what-the-dark-web-looks-l…

2 2

Fwd: Re: [Cryptography] "Flip Feng Shui: Hammering a Needle in the Software Stack"
by Georgi Guninski 04 Sep '16

04 Sep '16

----- Forwarded message from Georgi Guninski <guninski(a)guninski.com> ----- Date: Sat, 3 Sep 2016 08:49:34 +0300 From: Georgi Guninski <guninski(a)guninski.com> To: Jerry Leichter <leichter(a)lrw.com> Cc: Florian Weimer <fw(a)deneb.enyo.de>, Cryptography List <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] "Flip Feng Shui: Hammering a Needle in the Software Stack" On Fri, Sep 02, 2016 at 10:56:10AM -0400, Jerry Leichter wrote: > > Why bother with patching public keys, making them amenable to > > factorization, if you can patch executable code instead? > > > > If you can target executable code (and I see why not, it's all the > > same to KSM), it is very clear that there cannot be a software-only > > defense.... > The technique cannot be aimed exactly: You can flip some unpredictable, uncontrollable subset of the bits in a word. (The vulnerability of particular bits is dependent on physical variations in the memory cells.) > ... > Attacks against the executable code are certainly the worst case, and you might be able to find security-sensitive but very rarely executed code to attack. But this is likely much harder to pull off than the attack outlined here. > Flipping random bits in a word at chosen location is very powerful primitive. I am taking bets that it is moderately easy to exploit via many vectors. Flipping random bits of zero word make it nonzero. In a boolean context, this flips False and True, screwing the logic. eg in: if(is_root || is_authorized) give_em_power(); else drop_em(); ----- End forwarded message -----

2 2

PC-BSD Follows a Rolling Release Model, Gets Renamed To TrueOS
by grarpamp 04 Sep '16

04 Sep '16

http://linux.softpedia.com/blog/pc-bsd-operating-system-gets-renamed-to-tru… https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/ We are proud to announce that the PC-BSD project has evolved into TrueOS: a modern, cutting-edge distribution of FreeBSD focused on security, simplicity, and stability for desktops, servers, and beyond! TrueOS harnesses the best elements of PC-BSD, combines it with security technologies from OpenBSD, and layers it on top of FreeBSD to provide a complete system for modern machines. TrueOS combines the convenience of a rolling release distribution with the failsafe technology of boot environments, resulting in a system that is both current and reliable. TrueOS now tracks FreeBSD’s “Current” branch and merges features from select FreeBSD developer branches to enhance support for newer hardware and technologies. Weekly automatic updates keep your system always up-to-date, and all updates are performed safely within system snapshots called boot environments. The TrueOS desktop uses the modular yet feature-rich Lumina desktop environment alongside the new SysAdm administration suite to provide a reliable desktop experience. SysAdm provides local and remote management of TrueOS and FreeBSD systems using a cross-platform graphical client compatible with Windows, Mac, and many Linux distributions. TrueOS is preconfigured for desktop and server installations using an intuitive graphical installer, taking the guesswork out of setting up a new system. Beta-quality images of TrueOS are currently available on trueos.org for users to help test in preparation for the upcoming release. These images demonstrate the rolling-release model and will seamlessly transition into the release version of TrueOS. As always, we thank you for your feedback and for being dedicated members of our community. TrueOS Features: Now a rolling release based on FreeBSD-CURRENT. Weekly package/ISO updates (or more often, as necessary). Only one package repository. Update when you’re ready and never get left behind again. Automatic updates can be enabled/disabled as desired. All updates are performed in a safe manner using Boot Environments. Updates never change your live system, as the updated system is not activated or used until you reboot Existing PC-BSD/FreeBSD users can use the non-destructive fresh installation into a new boot environment on non-encrypted ZFS pools. This mechanism preserves all user data while performing a fresh install of the operating system and all applications. Simply re-create any user accounts post-installation to access the data in their home directories TrueOS Desktop pre-installs a pure Qt5 system based around the Lumina desktop and SysAdm. TrueOS Server pre-installs the SysAdm service for remote system management, with remote access initially disabled. A full repository of applications is available for installation through AppCafe. TrueOS is currently in Beta status. All of the critical functionality is complete, but we are still migrating some utilities from PC-BSD to the new TrueOS framework. Differences from FreeBSD 11.0: LibreSSL has replaced OpenSSL completely, even in the FreeBSD base. Linux DRM 4.7 compatibility adds support for the Haswell, Broadwell, and Skylake Intel graphics. The entire system, including the FreeBSD base, is managed by pkg.

2 1