October 2017 - cypherpunks - lists.cpunks.org

dark web briefest intro - was Re: educate me Please
by Zenaan Harkness 09 Oct '17

09 Oct '17

----- Forwarded message from Zenaan Harkness <zen(a)freedbms.net> ----- > Hi Zee, What is the reality of this dark web? If it doesn't show > on Google, then how can you find it? ... As to the dark web - it certainly exists. As we see on the news, every 2 or 4 years the authorities take down one or other of the largest dark web "market place" websites - so evidently these places attract a lot of people. And then there are the smaller sites they take down which usually don't hit the front page of the news. There are all sorts of dark web sites - market places, forums, simple websites, ssh gateways (apparently a lot of people access their normal web servers over ssh), and apparently a lot of ways to slip up for those doing something illegal - and Tor is designed so that the large state-level authorities can pretty much always uncover someone if that's what they want to do; Tor is not secure against GPAs (Global Passive Adversaries), and is absolutely not secure against an active adversary. One of the key features that the Tor company/group has never implemented is chaff-filled network - that is, you specify "I want to allocate 100 KB/s to my node, and I want that divided equally amongst my outward connections, and any peer node that "randomly drops" packets, becomes less trusted by me. I asked the devs directly (or someone else did, can't remember for sure), and the reason came back "our funding proposals for this feature have never been approved" - which makes sense, since the CIA, DIA, DOD and NSA fund the creation of the Tor network, they don't want to fund features which make it much harder for them to uncloak users they are targetting. A volunteer could also try to implement this feature, but it's a lot of work, and even the I2P folks have not yet even tried to implement it. So, even if you were researching data/info for a book you are writing, you really need to spend a lot of time reading about the security aspects, to find out what can give you even a small modicum of "reasonable plausible deniability" for your research activities. For example: - run an exit node (carries its own risks, but one of the better ways to achieve plausible deniabililty) at home - alternatively, or in addition, configure your node as a bridge/ Tor-network entry node, and invite a handful of friends to use it as their gateway to the Tor network (the alternative, if you don't run your own node, is that Tor browser picks a random node to use to enter the Tor network, and there's a damn good chance the CIA or FBI are running that node) - don't run Tor browser on Windows - don't run Windows of any version - learn Qubes OS or Tails OS and use that - experiement for a few months with something completely innocuous - running a website promoting information about Marijuana or something, and once you're comfortable, then move on to something more innocuous - if you choose to run a Tor node (can increase the security, can reduce it if you stuff up the config) there are plenty of folks on the Tor mailing lists who will answer questions, and plenty of links to read to Stay Safe (C)(R) - if you intend to run a dark web website that some authorities really would not like - say e.g. promoting homosexuality to the Saudi's - then you should really be running your own ISP with multiple internet links (e.g. Telstra and Optus), so that any virtual servers you link into the dark web are relatively robust; then, never allow your website to get too popular - keep it to a very manageable number of invitees - never make your invites over the clear net (normal internet) only invite truly trusted friends in person, face to face, with mobile phones turned off and out of reach of all recording devices (including of course, all phones); to invite random people, do so on a dark web forum only. - if you're going to run a dark web website, you really, really, really need to know how to configure firewalling, web server, https certificates, ssh for admin access etc etc, in such a way as to be truly, actually, secure, if there's any chance your website is going to be targetted by the local authorities from your own jurisdiction, you need to not make even 1 single mistake - that mistake will bring you undone! Good luck :) Zen ----- End forwarded message -----

7 15

IBM OpenPOWER9 CPU [re: Closed Intel / AMD Firmware]
by grarpamp 09 Oct '17

09 Oct '17

On Sun, Oct 8, 2017 at 3:11 PM, Steven Schear <schear.steve(a)gmail.com> wrote: > Why not switch to much more open CPUs (e.g. POWER8/9) which are already > comparable to much of Intel's higher end server chips. Power8 is an intermediate generation now on phaseout, where Power9 seems more part of a fuller openpower initiative that might stand up to Intel / AMD. The entire early 9 production output was being vacuumed up by military / big data / compute, and retail is taking a while to evolve. It's good stuff however power is still an expensive platform for non enterprise end users to just buy casually, and to pay electric on, but the openness might win. Power9 scaleout SO is rather less than scaleup SU versions. If you want me to switch and get in the game early, perhaps with review coinmining and shell ftw, you know what to do... ;) BTC:1CQYSaF8Cqx5ZSgaKG9LE8UrEJAkWqFpLa https://wikipedia.org/wiki/OpenPOWER_Foundation https://wikipedia.org/wiki/POWER9 https://news.ycombinator.com/item?id=12351319 https://www.nextplatform.com/2016/04/06/inside-future-google-rackspace-powe… https://blog.rackspace.com/the-latest-zaius-barreleye-g2-open-compute-openp… https://www.nextplatform.com/2017/09/19/power9-rollout-begins-summit-sierra/ https://www.enterprisetech.com/2014/07/15/open-sourced-bios-helps-power8-co… http://www.theplatform.net/2015/03/23/inside-the-rackspace-openpower-megase… https://www.servethehome.com/?s=openpower https://www.anandtech.com/SearchResults?q=openpower http://www.storagereview.com/search/node/openpower https://hn.algolia.com/?query=power9&sort=byDate&prefix&page=0&dateRange=al… https://raptorcs.com/TALOSII/ https://raptorcs.com/content/base/faq.html https://news.ycombinator.com/item?id=14956257 http://tyan.com/campaign/OpenPOWER/ https://github.com/open-power https://github.com/openbmc https://wiki.freebsd.org/POWER8 https://www.freebsdnews.com/2015/03/04/freebsd-power8-its-alive-2/ https://svnweb.freebsd.org/base?view=revision&revision=279189 https://www.freebsd.org/news/status/report-2015-01-2015-03.html#FreeBSD-on-… https://reviews.freebsd.org/search/query/oIdoWWKTe71p/ https://www.phoronix.com/scan.php?page=news_item&px=Linux-4.8-More-POWER9 https://www.phoronix.com/scan.php?page=news_item&px=Power-Changes-Linux-4.12 https://www.phoronix.com/scan.php?page=news_item&px=Raptor-Talos-2-Teaser https://www.phoronix.com/scan.php?page=news_item&px=Talos-2-POWER9-Pre-Order https://www.phoronix.com/scan.php?page=news_item&px=Talos-2-FSF-RYF-Possible http://www.fsf.org/resources/hw/endorsement/respects-your-freedom https://www.fsf.org/blogs/licensing/only-a-short-time-left-to-pre-order-the… Minimum to boot and scale cost users roughly $3300 incl 2x cpu, ps, 32gb.

1 0

Julian Assange Told Young Catalans What Chat Apps To Use To Avoid Spanish Authorities
by Cecilia Tanaka 09 Oct '17

09 Oct '17

Cute news! <3 https://www.buzzfeed.com/ryanhatesthis/the-story-of-the-catalan-independenc… ====== Public Long OT PS to ZH: - Zenaan Harkness, stop sending fake messages and spam from MatchSeniors.com and similar dating sites using my name. It's always disgusting to notice there are so hypocrite, vile and stupid people like you in the world. You could use all your free time to help people instead of trying to hurt me and others. Sorry, the mud will always be mud. You can try to cover other persons' shine with your dirtiness, your lies, but you can't do it for much time and, if necessary, there will be return. ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

1 0

FreeBSD 2017Q2 Report
by grarpamp 09 Oct '17

09 Oct '17

https://www.freebsd.org/news/status/report-2017-04-2017-06.html

1 0

Anarchist AI: The Last Invention Of Man
by grarpamp 09 Oct '17

09 Oct '17

http://nautil.us/issue/53/monsters/the-last-invention-of-man https://news.ycombinator.com/item?id=15419619 Nautil.us Issue 053: Monsters The Last Invention of Man How AI might take over the world. By Max Tegmark The Omega Team was the soul of the company. Whereas the rest of the enterprise brought in the money to keep things going, by various commercial applications of narrow AI, the Omega Team pushed ahead in their quest for what had always been the CEO’s dream: building general artificial intelligence. Most other employees viewed “the Omegas,” as they affectionately called them, as a bunch of pie-in-the-sky dreamers, perpetually decades away from their goal. They happily indulged them, however, because they liked the prestige that the cutting-edge work of the Omegas gave their company, and they also appreciated the improved algorithms that the Omegas occasionally gave them. What they didn’t realize was that the Omegas had carefully crafted their image to hide a secret: They were extremely close to pulling off the most audacious plan in human history. Their charismatic CEO had handpicked them not only for being brilliant researchers, but also for ambition, idealism, and a strong commitment to helping humanity. He reminded them that their plan was extremely dangerous, and that if powerful governments found out, they would do virtually anything—including kidnapping—to shut them down or, preferably, to steal their code. But they were all in, 100 percent, for much the same reason that many of the world’s top physicists joined the Manhattan Project to develop nuclear weapons: They were convinced that if they didn’t do it first, someone less idealistic would. The AI they had built, nicknamed Prometheus, kept getting more capable. Although its cognitive abilities still lagged far behind those of humans in many areas, for example, social skills, the Omegas had pushed hard to make it extraordinary at one particular task: programming AI systems. They’d deliberately chosen this strategy because they had bought the intelligence explosion argument made by the British mathematician Irving Good back in 1965: “Let an ultraintelligent machine be defined as a machine that can far surpass all the intellectual activities of any man, however clever. Since the design of machines is one of these intellectual activities, an ultraintelligent machine could design even better machines; there would then unquestionably be an ‘intelligence explosion,’ and the intelligence of man would be left far behind. Thus the first ultraintelligent machine is the last invention that man need ever make, provided that the machine is docile enough to tell us how to keep it under control.” They figured that if they could get this recursive self-improvement going, the machine would soon get smart enough that it could also teach itself all other human skills that would be useful. The First Millions.....

2 4

Huxley on Soma
by juan 09 Oct '17

09 Oct '17

"Most highly publicized of these [new drugs] are the three new tranquillizers, reserpine, chlorpromazine and meprobamate. None of these drugs is perfectly harmless; but their cost, in terms of physical health and mental efficiency, is extraordinarily low. In a world where nobody gets anything for nothing tranquillizers offer a great deal for very little. Miltown and chlorpromazine are not yet soma; but they come fairly near to being one of the aspects of that mythical drug. A more promising candidate for the role of soma in its third aspect is Iproniazid Still more promising, according to a distinguished pharmacologist of my acquaintance, is a new compound, still in the testing stage, to be known as Deaner" We see then that, though soma does not yet exist (and will probably never exist), fairly good substitutes for the various aspects of soma have already been discovered. There are now physiologically cheap tranquillizers, physiologically cheap vision-producers and physiologically cheap stimulants"

1 0

Bypassing Intel Boot Guard, EdDSA
by grarpamp 09 Oct '17

09 Oct '17

https://embedi.com/blog/bypassing-intel-boot-guard https://github.com/flothrone/bootguard https://github.com/REhints/BlackHat_2017 https://github.com/tianocore/edk2 https://en.wikipedia.org/wiki/Trusted_Platform_Module https://embedi.com/blog Killchain of IoT Devices Betraying the BIOS: Where the Guardians of the BIOS are Failing In recent years, there is an increasing attention to the UEFI BIOS security. As a result, there are more advanced technologies created to protect UEFI BIOS from illegal modifications. One of such technologies is Intel Boot Guard (BG) – a hardware-assisted BIOS integrity verification mechanism available since Haswell microarchitecture (2013). So-called «UEFI rootkits killer» this technology is designed to create a trusted boot chain (where a current boot component cryptographically measures/verifies the integrity of the next one) with Root-of-Trust locked into hardware. How is that possible? Let’s take a look... https://news.ycombinator.com/item?id=15414760 https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-fault… How to defeat Ed25519 and EdDSA using faults This work was performed with my colleague Sylvain Pelissier, we demonstrated that the EdDSA signature scheme is vulnerable to single fault attacks, and mounted such an attack against the Ed25519 scheme running on an Arduino Nano board. We presented a paper on the topic at FDTC 2017, last week in Taipei. https://www.openbsd.org/62.html Release iminent.

3 3

Cryptocurrency Privacy: Evolving... Zerocash (ZEC, ZCL, ZEN) vs All Other Coin
by grarpamp 09 Oct '17

09 Oct '17

Rethreading these two former threads into a more General: Item... 1: Zerocash: Addressing Bitcoin's Privacy Problem GoogleTechTalks 2: Why I can't sleep soundly with blockchain, being the cypherpunk ########## https://zcoin.io/zcoins-privacy-technology-compares-competition/ > Blockchain privacy is a particularly difficult thing to achieve as a public blockchain is designed so that all transactions are transparent and the supply of coins can be publicly verified. Privacy mechanisms have to ensure that these elements are preserved so it’s a conflicting mix of protecting privacy while maintaining public verifiability. That's obsolete thinking. And to open coin comparisons with such statements misleads the reader into believing that supposedly "private" coins that retain elements of that thinking are an ok thing. The point of a cryptographically private coin is to hide everything that might permit traceability under the shield of strong crypto (including support for transport over anonymous networks). Unlike mix coins, crypto shielding is its privacy mechanism. One doesn't need to have, see, and verify for such a coin all the old traditional bits of a public ledger blockchain... transactions, utxo balances, addresses, coin supply... because the crypto should enforce those parts are working, and make them immune from attack. Provided the crypto is solid, the coins below may be better at privacy than all other in-production, non zerocash based, coins to date. https://en.wikipedia.org/wiki/Zerocash https://z.cash/ - Zcash ZEC http://zclassic.org/ - Zclassic ZCL https://zensystem.io/ - Zencash ZEN Further old and misleading arguments against them... > Private transactions take a while to generate (almost a minute on a decently powerful computer) Old news is old... https://z.cash/blog/cultivating-sapling-faster-zksnarks.html > Complicated trusted setup / traceable / backdoored Don't like it? Take more time in understanding and peer reviewing it, preparing and injecting openness, reproducibility, philosophy, documentation and auditability into the process in advance... and restart. The first Zerocash ceremony is not the only such ceremony the world will ever see in the crypto space. And the first one might be as good. Add this new post to the list of links on the list / net about ceremony... https://z.cash/blog/ceremony-audit-results.html > setup that has to be done by the developers. False. It can be done by any group having any number of participants in an opensource reproducible and public fashion. The design, process, and results can all be posted and then imported by new projects as needed. Further, is it true that, in software release for current production Z coins, that new parameters can be dropped in place of old parameters for new transactions on their chains going forward? https://github.com/zcash/zcash/issues/2247 > Supply cannot be audited therefore forgery can be very difficult to detect. Bogus Arg. If setup is secure, and crypto enforces against forgery, then requiring blockchain be "public" about supply for auditability is moot. And even if the blockchain is not auditable, forging coin creation can still be detected by the community knowing its own real world size throwing funds into the coin, yet the price and walls aren't moving as they should over time. And a whole lot of Lambos rolling around till it gets leaked / rediscovered and fixed. > Uses relatively new cryptography Crypto was new. Bitcoin was new. Cryptocurrency is still new. Regulation is still new and is a nearly equivalent goes-to-zero threat. Get cryptocurrency out there, get it peer reviewed, get it in production. Don't put in more than you want to lose. Here are some corporate reviewers and users that are either traps and/or investing huge sums they cannot afford to allow to lose... https://www.americanbanker.com/news/worlds-collide-jpm-works-with-team-behi… https://github.com/jpmorganchase/quorum http://entethalliance.org/ >> https://steemitimages.com/DQmSzRp3XQCXwQ1Y14jTNLcBw1XQ9rZ6oNz1XbnZxHomME3/i… > Bitcoin Core Version Both ZEC and ZEN should merge back into each other some of their own improvements and fixes, including importing any recent useful stuff from original parent codebase of BTC. Normal opensource process. > Hides tx amount / Optional privacy defaults Mix vs Transparent and Shielded... Well then don't use mixes or transparent, get it migrated and committed out of the code forever... https://imgur.com/gallery/MWdwh https://github.com/zcash/zcash/issues/2248 > Compute time Outdated info. See sapling tech above. > Incentivised Nodes / Pruneable / Scaling These issues affect all cryptocurrencies in some way. Zencash ZEN has some work potentially evolving incentive structures https://zcoin.io/zcoin-development-update-znodes-and-scaling-zerocoin/ > Trusted setup Sly word choice. Call it "DASTp - distributed any single trust prevails" or something more technically representative like that. Here's another long debate... https://www.reddit.com/r/CryptoCurrency/comments/737is9/charlie_lee_tells_s… This note isn't really meant to compare coins versus each other (they could all be shit), but to hint that the amount of FUD and outdated arguments being used out there to compare them... especially by their very own developers and communities who should know better... should be of concern and needs improved. Even an armchair reviewer could get rich starting up a site devoted solely to more objective comparisons and tracking development news and roadmaps. https://www.americanbanker.com/news/cheat-sheet-the-trade-offs-of-blockchai… "Each of these technologies solves a fraction of the puzzle, but we are beginning to see how they can be stitched together to deliver more complete privacy. A lot of the implementations take multiple different technologies and combine them together to achieve an additive result. It may well be that a combination of different technologies emerges as being a better solution." Prediction: Crypto-private coins will eventually outpace and surpass mix-private coins as knowledge of crypto continues to increase around the world. Send your wagers and comments here... btc:199WA27L4tVazpg2Bqzas2cX7nomqP4ZEp It's early days, keep your eyes open and your cryptocurrency ready.

4 10

Audio wcn interview
by jim bell 08 Oct '17

08 Oct '17

https://m.soundcloud.com/worldcryptonet/tones-ma-93-the-bitcoin-breakout-is… Sent from Yahoo Mail on Android

2 1

Amir Taaki @HCPP2017 Hackers Congress Parallel Polis 2017
by grarpamp 08 Oct '17

08 Oct '17

https://www.youtube.com/watch?v=h1MpJO-vlF8 https://www.coindesk.com/radical-academy-amir-taakis-new-hacker-team-spread…

1 0