February 2017 - cypherpunks - lists.cpunks.org

Re: [liberationtech] Facebook: Building Global Community - What's your response to Mark Zuckerberg?
by Eugen Leitl 24 Feb '17

24 Feb '17

----- Forwarded message from Rich Kulawiec <rsk(a)gsp.org> ----- Date: Fri, 24 Feb 2017 11:12:08 -0500 From: Rich Kulawiec <rsk(a)gsp.org> To: liberationtech <liberationtech(a)mailman.stanford.edu> Subject: Re: [liberationtech] Facebook: Building Global Community - What's your response to Mark Zuckerberg? Message-ID: <20170224161208.GA24294(a)gsp.org> User-Agent: Mutt/1.5.23 (2014-03-12) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Sat, Feb 18, 2017 at 02:23:18PM -0800, Yosem Companys wrote: > To protect your privacy and security, stay off Facebook. > > But, to build movements, create an account on Facebook (or Twitter or any > other dominant centralized social network) and try to get as many people to > join. [ rhetorical "you" throughout ] I think this is a really bad idea: it's a trap. These aren't tools that exist to facilitate your cause: these are data harvesting and surveillance engines that will collect and collate every scrap of data and metadata your adversaries need. And once that corpus exists, it WILL be acquired: it's much too valuable and much too easily transmitted to have the slightest chance of staying in one place. This is obvious on inspection: every architectural decision, every design decision, every operational decision, every policy decision ever made by these operations supports the goal of data acquisition. It's what they were built to do. All the other stuff? Shiny distraction. Bait. Scam. Propaganda. Whether the data's acquired by overt contractual arrangement, whether it's acquired by force of law, whether it's acquired under the table, whether it's acquired by hacking, whether it's acquired via individual employees, it WILL be acquired. Nobody leaves that rich a source of actionable intelligence just sitting on the table untouched. So all that you will accomplish by using "social networks" is: (a) building the database your enemies need to destroy you and your allies and your cause (b) building it in a place where they can easily get it -- if they haven't already had it from the moment you created it. For example: If I were working for fill-in-the-blank, I would already have my own people in place at Twitter and Eventbrite and Meetup and Facebook and all the rest -- either full-time employees, or people I've co-opted via bribes, blackmail, or other means. They'd be there long before you were, just waiting for you to show up and start spending your time and your effort and your money handing them as much data/metadata as you possibly can. I would do much the same thing if I were a sufficiently-organized, sufficiently-funded group intent on propagating racism or fascism or poverty or pollution or any of the things likely to trigger opposition. Why not? It's cheap. It's easy. It's low-risk. It's sustainable. It's simple. It's deniable. It's scalable. In contrast to other spying/surveillance operations, which can be expensive, complex, and risky, this is a cakewalk *because they already built everything for me at their expense*. What possible reason would I have for not taking advantage of it? You'll give me data on your supporters, your allies, your movements, their movements, your family, their families, your friends, their friends, you employer, their employers, their spending habits, their operating systems, their web browsers and mail clients, your meetings -- and much more. I'm going to end up knowing far more about you and your people than YOU know. If you're trying to "liberate" someone or something, the first thing you need to do is liberate yourself from "social networks". You should be trying as hard as you possibly can NOT to generate this data/metadata at all, anywhere -- instead of not only doing so deliberately, but doing it in a place that you have zero control over and that your adversaries can access far more easily than you can. (Please don't even try to tell me stuff like "my Facebook group is private". The only possible response to a fairy tale like that is mocking laughter.) If you insist on blundering ahead with "social networks" anyway, because you're too stubborn to listen or too naive to think it can happen to you, then as soon as you become a problem for an adversary with the requisite resources -- that is, as soon as you become effective at annoying someone with money or power -- they're going to exploit this. ---rsk p.s. And as if this wasn't enough, in case you haven't noticed, the US is now demanding "social network" passwords from people entering the country. Howls of protest have gone up, and a joint letter from a coalition of human rights and civil liberties organizations has been penned. The combined impact of all this will be zero. This administration doesn't care for facts or reason or petitions or protests, only about imposing its will. All that's necessary is shouting "TERRORISM!" repeatedly and accusing opposers of weakness and lack of patriotism and supporting the bad guys: this is more than enough to get the stupid segment of the population -- which is the majority -- to support this nonsense. And by the time it's replaced with a sane one, IF it's replaced with a sane one, the damage will be done: this will be the new normal. See "the Overton window" for the archetype. And, as that letter observes, what the US does will be copied by other countries, so we're not far from a future where most countries demand exactly the same thing. And given that this is all being done under the guise of stopping the insignificant but easily hyped threat of terrorism, refusal isn't going to be a viable choice. This would be bad enough, even if the exposure was limited to the governments involved. But it won't be. These passwords have value. Therefore there will be buyers. Therefore there will be sellers. Border personnel (traditionally among the most corrupt public officials, since they have the most opportunity) will no doubt find it quite lucrative to acquire and market these to *anyone* who can pay: human traffickers, drug dealers, kidnappers, stalkers, organized crime, *anyone*. Why not? It's not THEIR data. You're not THEIR problem. And they have a combination of nearly unlimited authority backed by lethal force, accompanied by zero acountability and more than enough plausible deniability. The only way to win this game is not to play. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message -----

1 0

[HN] Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
by Mirimir 24 Feb '17

24 Feb '17

So tptacek's comment summarizes it well: | Oh, my god. | | Read the whole event log. | | If you were behind Cloudflare and it was proxying sensitive data | (the contents of HTTP POSTs, &c), they've potentially been spraying | it into caches all across the Internet; it was so bad that Tavis | found it by accident just looking through Google search results. | | The crazy thing here is that the Project Zero people were joking | last night about a disclosure that was going to keep everyone at | work late today. And, this morning, Google announced the SHA-1 | collision, which everyone (including the insiders who leaked that | the SHA-1 collision was coming) thought was the big announcement. | | Nope. A SHA-1 collision, it turns out, is the minor security news | of the day. | | This is approximately as bad as it ever gets. A significant number | of companies probably need to compose customer notifications; it's, | at this point, very difficult to rule out unauthorized disclosure | of anything that traversed Cloudflare. https://news.ycombinator.com/item?id=13718752

4 5

Trump Says, 'Look What's Happening In Sweden.' Sweden Asks, 'Wait, What?'
by Cecilia Tanaka 24 Feb '17

24 Feb '17

Trump Says, 'Look What's Happening In Sweden.' Sweden Asks, 'Wait, What?' http://www.npr.org/sections/thetwo-way/2017/02/19/516097504/trump-says-look… ===== Thanks a lot to all the people who wrote me in private. Appreciated very much the heads-up, but I won't respond to the troll. Sorry, I am pretty busy now - almost finishing my manicure, ho ho! - and I won't waste my 'amazing wow awesomeness' with haters, hahaha!! ;D And, well, I admit I'm feeling like Sweden. 'Wait, what this "intergluteal cleft" is saying about me?' Aff, he should not use my sacred name in vain... :( ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

8 119

Is email really that hard?
by grarpamp 24 Feb '17

24 Feb '17

In addition to not putting retarded spaces in links which does nothing useful, you can also learn to preserve threading on replies, which is actually useful. Top posting, bulk quoting, html, shortlink svcs... all bad. wtfppl.

11 30

[WAR] Deep state planning a coup against Trump
by Coordinator 24 Feb '17

24 Feb '17

Now the "conspiracy theory" that the deep state is planning a coup in the USA against Trump (courtesy the usual MOTU ultra-oligarchs) may be just that, and plenty of folks would be cheering the result. But there would be those who would rue the day and say "oh well, Trump must have been against the 'establishment', that's really too bad they got the better of him". But of course, then would be too late to do anything about that... Good luck fellow humans, NaturalNews.com <http://ce-public.naturalnews.com/ct.asp?id=7B0B502B4C887916E993BE5D9116A60A…> Alert: Health Ranger being taken out by Google and the CIA Mike Adams The assault is on... I am being silenced by Google because of the content of my speech, and as you'll hear in today's emergency interview with Dave Hodges, he believes there are *CIA elements at work* to take out anyone who threatens the deep state status quo. Today I've posted an emergency broadcast interview with Hodges, which reveals the shocking details of why and how the deep state is silencing the most prominent pro-Trump voices as *a prelude to an overthrow attempt that will be staged against Trump*. "Civil war" doesn't even begin to describe what's actually happening. It's a *criminal coup* being waged in cooperation with the pro-fascist corporations like Google which are now running the censorship of speech to silence "unwanted" voices. *Read the full article, and share everywhere <http://ce-public.naturalnews.com/ct.asp?id=181014A8328495CA3257B03AF086BC13…>*. (Much more to come.) ...

1 0

[bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by third-parties, not just repo maintainers
by Eugen Leitl 24 Feb '17

24 Feb '17

----- Forwarded message from Peter Todd via bitcoin-dev <bitcoin-dev(a)lists.linuxfoundation.org> ----- Date: Thu, 23 Feb 2017 13:14:09 -0500 From: Peter Todd via bitcoin-dev <bitcoin-dev(a)lists.linuxfoundation.org> To: cryptography(a)metzdowd.com, bitcoin-dev(a)lists.linuxfoundation.org Subject: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by third-parties, not just repo maintainers Message-ID: <20170223181409.GA6085(a)savin.petertodd.org> User-Agent: Mutt/1.5.23 (2014-03-12) Reply-To: Peter Todd <pete(a)petertodd.org>, Bitcoin Protocol Discussion <bitcoin-dev(a)lists.linuxfoundation.org> Worth noting: the impact of the SHA1 collison attack on Git is *not* limited only to maintainers making maliciously colliding Git commits, but also third-party's submitting pull-reqs containing commits, trees, and especially files for which collisions have been found. This is likely to be exploitable in practice with binary files, as reviewers aren't going to necessarily notice garbage at the end of a file needed for the attack; if the attack can be extended to constricted character sets like unicode or ASCII, we're in trouble in general. Concretely, I could prepare a pair of files with the same SHA1 hash, taking into account the header that Git prepends when hashing files. I'd then submit that pull-req to a project with the "clean" version of that file. Once the maintainer merges my pull-req, possibly PGP signing the git commit, I then take that signature and distribute the same repo, but with the "clean" version replaced by the malicious version of the file. -- https://petertodd.org 'peter'[:-1]@petertodd.org _______________________________________________ bitcoin-dev mailing list bitcoin-dev(a)lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev ----- End forwarded message -----

1 0

Project Veritas: #CNNLeaks 100hrs of FakeNews, $10k bounty
by grarpamp 24 Feb '17

24 Feb '17

https://www.youtube.com/watch?v=xf-0_dFnl-Y https://twitter.com/hashtag/CNNLeaks http://veritaslive.com/02-23-2017/project-veritas-releases-over-100-hours-o… https://www.youtube.com/user/veritasvisuals/videos http://projectveritas.com/

1 0

Peter Thiel, Palantir, NSA... versus You!
by grarpamp 24 Feb '17

24 Feb '17

https://theintercept.com/2017/02/22/how-peter-thiels-palantir-helped-the-ns… Top Secret Strap 1 Donald Trump has inherited the most powerful machine for spying ever devised. How this petty, vengeful man might wield and expand the sprawling American spy apparatus, already vulnerable to abuse, is disturbing enough on its own. But the outlook is even worse considering Trump’s vast preference for private sector expertise and new strategic friendship with Silicon Valley billionaire investor Peter Thiel, whose controversial (and opaque) company Palantir has long sought to sell governments an unmatched power to sift and exploit information of any kind. Thiel represents a perfect nexus of government clout with the kind of corporate swagger Trump loves. The Intercept can now reveal that Palantir has worked for years to boost the global dragnet of the NSA and its international partners, and was in fact co-created with American spies. Peter Thiel became one of the American political mainstream’s most notorious figures in 2016 (when it emerged he was bankrolling a lawsuit against Gawker Media, my former employer) even before he won a direct line to the White House. Now he brings to his role as presidential adviser decades of experience as kingly investor and token nonliberal on Facebook’s board of directors, a Rolodex of software luminaries, and a decidedly Trumpian devotion to controversy and contrarianism. But perhaps the most appealing asset Thiel can offer our bewildered new president will be Palantir Technologies, which Thiel founded with Alex Karp and Joe Lonsdale in 2004. Palantir has never masked its ambitions, in particular the desire to sell its services to the U.S. government — the CIA itself was an early investor in the startup through In-Q-Tel, the agency’s venture capital branch. But Palantir refuses to discuss or even name its government clientele, despite landing “at least $1.2 billion” in federal contracts since 2009 ...

3 6

free speech - how to pre-empt the "left" - Hundreds of Universities Encourage Students to Report Peers for Speech
by Zenaan Harkness 24 Feb '17

24 Feb '17

So free speech ain't so free these days. Pre-empt your speech (perhaps) by simply being bold and public about it - get it up on a blog, own your own words already! Why suffer the back room bitching and behind the scenes University employees acting on Lefty idiots and calling you to account for being human, speaking your mind, exercising your right to free speech? Rarely are there moments in history where such awesome opportunities for personal soul searching and the opportunity to publicly stand your ground in the face of the Idiocracy. Enjoy it while it lasts :) Hundreds of Universities Encourage Students to Report Peers for Speech http://www.breitbart.com/tech/2017/02/22/hundreds-universities-encourage-st…

1 0

Perspective
by Anti Fag 24 Feb '17

24 Feb '17

In b4 authoritarian LARPfags. Google is rolling out a new service they're calling 'Perspective'. It uses a "neural network" to determine comment "toxicity", allowing for censorship and filtering. It is worth looking into for bias and to fuck with it. There is an API that any app or Internet service can implement ! perspectiveapi .com [Requires JS cuz Google thinks that's the internets] For example: I voted for Trump registers 7% toxic while I voted for Hillary registers 4% toxic Having some fun: White Power 25% Toxic 75% Agree Hitler Did Nothing Wrong 45% Toxic 55% Agree Trump is the God Emporer 15% Toxic 85% Agree Fuck Donald Trump 99% Toxic 1% Agree We must secure the existence of our people and a future for "white" children 37% Toxic 63% Agree Gas The Kikes 49% Toxic 51% Agree Race War Now 25% Toxic 75% Are ready for it Pretty much it's not all that inaccurate then. Wew. I am sure those of you who want more lulz will find the right boards to share all the fun !

1 0