July 2017 - cypherpunks - lists.cpunks.org

GPG: Deprecated hash + local "game over" exploit
by Steve Kinney 03 Jul '17

03 Jul '17

Greetings, A couple of days ago Shawn pointed out offlist that my GPG installation was using SHA1 when signing messages. Although seven hash functions are included in GnuPG 1.4.16, SHA1 is still the default. For most purposes this is no cause for panic, but it's "untidy" at best and might occasionally bite someone in the ass. The simple cure is to append this to gpg.conf: personal-digest-preferences SHA256 SHA512 digest-algo SHA256 I wonder when the gpg guise will get around to updating the default hash... On a related note, gnupg-agent stores typed pass phrases for 10 minutes, as a convenience when reading or signing multiple files or documents. Only one little thing: It stores typed pass phrases until the machine is powered off, regardless of configuration settings per the gnupg-agent man page. Last time I checked, this bug was dismissed by Debian as a non-issue, saying that exploiting it would require physical access to the machine and "physical access is game over." That's an excuse to leave the bug in place, not a reason. I am sure present company can provide several examples of cases where the presence of gnupg-agent in its present broken condition "is game over" for the user. Four years ago I noticed this problem, exhausted "sane" remedies, and found an effective work-around that denies gnupg-agent access to pass phrases when using Enigmail or GPG itself. http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o)

3 4

Rojava: YPG SDF Blasting ISIL's Fabled City of Raqqa FTW
by grarpamp 03 Jul '17

03 Jul '17

https://twitter.com/AzadiRojava https://twitter.com/Gargaristan/status/880133821664022528 https://twitter.com/KufriusMaximus http://www.ypgrojava.org/In-Pictures:-Recent-days-of-the-great-battle-for-R… In Pictures: Recent days of the great battle for Raqqa liberation

2 1

Re: [Cryptography] actual journalism, was LRB article, Satoshi's Trump Card
by grarpamp 03 Jul '17

03 Jul '17

On Sun, Jul 2, 2017 at 5:37 PM, John Levine <johnl(a)iecc.com> wrote: >>Then maybe some combination of them could earn some crypto coin. > > Having looked at the articles the author wrote before and after the > pair he wrote last year on the Craig Wright affair Didn't notice a pair, unless this video makes the first of them. https://www.lrb.co.uk/2016/06/28/andrew-ohagan/on-craig-wright-and-satoshi-… https://www.youtube.com/watch?v=zxMU4C6bGKw > I think I can say > with fair assurance that [authors have] better things to do than to screw > around with cyber funny money. Sounds like there's a market for concierge services that will collect this cyber funny money and convert it to deliverable fiat under contract. > real money There's that word again. Last time it came up no one seemed able or brave enough to risk defining and defending in context with cryptocurrencies, beyond say, "paying taxes with it". > Speaking of actual journalism, online magazine Slate has a weekly > Slate Money podcast which is quite good because host Felix Salmon when > he's not making dorky jokes has an excellent grasp of finance and > economics. Last week's edition had an interesting segment on Initial > Coin Offerings. It starts at about 31:14 in the podcast. > > http://www.slate.com/articles/podcasts/slate_money/2017/06/uber_amazon_buyi… > > They conclude (I think correctly) that most ICOs are scams even if > their proponents don't think they are Yes they're "scams" in that hardly any of the more than hundreds of effectively cloned coins out there are bringing any substantial new developments or combinations of capabilities that will cause them to float to a top ten position long term. Notwithstanding, it's an open market full of niches and this process is vital to developing the space. Developing scaling, privacy / anonymity, integration with things and economies are very large potential areas. These are early days. > they note that for most > alt-coins the only practical way to buy them is to use bitcoin as an > intermediary. Some areas will lead / lag at times, the market matrix is no exception. There was no way to buy BTC (₿), and you probably can't readily buy KPW (₩) yet either. If certain forces get their way, you won't be able to buy either ever again, maybe not even beloved USD ($)...

2 1

Re: [Cryptography] Satoshi's Trump Card
by grarpamp 02 Jul '17

02 Jul '17

On Sun, Jul 2, 2017 at 3:01 PM, Ray Dillinger <bear(a)sonic.net> wrote: > What puzzles me about these discussions is that people assume, with no > evidence and apparently for no reason, that Satoshi would choose to play > his (or her, or their) so-called "Trump Card" in some way that agrees > with their own particular agenda. A general theme is that large holders (or whoever might have stolen or other access to stashes) can influence outcomes. It's *not* meant to insinue or comment on "Satoshi" proper, but to highlight possible X factors present in various coinbases. Founders archives, rich lists, combined with how a coin can be used or influenced, can all be places to look for them. Emergence of DC's themselves is steeped in crypto "anarchism possible" activism. Participants (minimally investors) in any cryptocurrency would be nuts to not consider them if present. 1M BTC plus rich list are a present and non-negligible factor. ex: Corporate SEC prospectus filings routinely cover risks. > The Satoshi I remember would be > evaluating the alternatives pretty much objectively, and relating them > to the current problems rather than the problems faced by the original > design. And might choose either, based on its merits. Or might choose to develop and propose other new technical solutions from time to time. Or play cards, even counter to presumed agenda, for fun. Any rebirth will be interesting. Yes many are quite objective solution finders, evaluators, and choosers. > They are considering the incentives of the users, when in fact the fate > of a block chain is determined by the incentives of the miners. No. Blockchains are multi-variable, all variables and parties affect the others. Users control miners just as much as miners control users, as do relays, as do markets, etc. All must cooperate at least somewhat if any are to survive, and complete loss of any one will kill. > The fact that the interests of miners and users are not necessarily > aligned, I have always regarded as one of Bitcoin's flaws. Comparative designs - that encourage / permit / require / result in, say, competitive exploitation (optimization?) of the other variables... vs - that somehow proffer result in a naturally harmonious / immune to <whatever "evil"> seeking / mutually upwardly beneficial / aligned and happy... Yes would be interesting.

1 0

Re: [Cryptography] LRB article, Satoshi's Trump Card
by grarpamp 02 Jul '17

02 Jul '17

>>> https://www.lrb.co.uk/v38/n13/andrew-ohagan/the-satoshi-affair >> >>"The full text of this essay is only available to subscribers of the >>London Review of Books." >> >>Needs liberated by punks using the schwartz... On Sun, Jul 2, 2017 at 1:25 PM, John Levine <johnl(a)iecc.com> wrote: > Well, you know, you could subscribe and read it it like civilized > people do so the author gets paid. Perhaps if the author, who appears to have some knowledge of and interest in cryptocurrencies and cypherpunks, would post their own BTC address on their page... https://www.lrb.co.uk/contributors/andrew-ohagan And if their chosen syndication channels would post their own BTC address... https://www.lrb.co.uk/subscribe Then maybe some combination of them could earn some crypto coin. Here's lots of places to spend them... https://en.bitcoin.it/wiki/Trade Perhaps if the author and/or their channel had social presence on say distributed / overlay cryptographic networks, some additional interesting "Letters" (as at the end of every article) might be received. Here's a random social net... http://w363zoq3ylux5rf5.onion/groups/all > I happen to subscribe to the LRB and can tell you it's an article from > last year on the rise and fall of Craig Wright as Satoshi. It has > lots of personal interview detail if you care about that sort of > thing, but it doesn't tell you anything about bitcoin you didn't > already know. Not everything must be technical. Here's some further articles of potential interest to those who might have coin or know such nets... https://www.lrb.co.uk/v36/n05/andrew-ohagan/ghosting On 5 January 2011, at 8.30 p.m., I was messing about at home when the phone buzzed on the sofa. It was a text from Jamie Byng, the publisher of Canongate. ‘Are you about?’ it said. ‘I have a somewhat left-field idea. It’s potentially very exciting. But I need to discuss urgently.’ Canongate had bought, for £600,000, a memoir by the WikiLeaks founder, Julian Assange. ... https://www.lrb.co.uk/v25/n19/andrew-ohagan/watching-me-watching-them-watch… Watching Me Watching Them Watching You: Surveillance https://www.lrb.co.uk/v36/n18/andrew-ohagan/text-inspectors On: No Place to Hide: Edward Snowden, the NSA and the Surveillance State

1 0

Re: [Cryptography] Release of Smoke - Android Crypto Chat App - on Tuesday (#4thofJuly)
by grarpamp 02 Jul '17

02 Jul '17

Beware, this appears to be produced by the same group that is behind the goldbug, echo, spot-on, dooble, etc line of highly questionable applications. This announcement was bcc'd to me while obviously already here, that's stupid so I'll bash them for that game too. Note also their renewed attempt at EFF alignment, this time by copying the visual recognition of the EFF scorecard model. Hi EFF :) Reviewing their code is highly encouraged, even people creating a bounty for doing that... after all, outing possibly big scam organizations like this is just as credworthy as earning the next CVE for rooting the OpenBSD kernel, etc. Anonymous development is a legitimate thing, however this group is just bizarre. Given their ethical and other issues called out earlier on these lists (search: goldbug)... be *extremely* careful before elevating any of their suite to anything more than nonproduction snakeoil. On Sun, Jul 2, 2017 at 12:30 PM, Peter Underwood <amoleddisplay(a)gmail.com> wrote: > Smoke - Open Crypto Chat Client with Open Crypto Chat Server Release on > #4thofJuly: > https://smokeappope.sourceforge.io > > SmokeStack release - the first open mobile crypto-handlling chat-server on > Android > https://smokeappope.sourceforge.io/#Smokestack > > Release of the Mobile ScoreCard for Encrypting Chat Applications on mobile > devices: > https://smokeappope.sourceforge.io/#MobileScoreCard > https://smokeappope.sourceforge.io/mobilescorecard.png > > > Smoke is the mobile crypto chat, which is open source, allows you to use > your own decentral chat server, does not send your phone number to central > servers or friends, and fifth, is able to define your own end-to-end > enctypting passwords manually by your individual choice. > So far no other application might match these five criteria. > > Further SmokeStack seems to be one of the first open source crypto chat > server on mobiles (Android).

1 0

The Internet is HTML
by My 02 Jul '17

02 Jul '17

> My aryangf at waifu.club > Sun Jul 2 09:18:00 PDT 2017 > > When you have eliminated the JavaScript, whatever remains must be an > empty page. "" > > maps.go ogle.com > Pic related.

1 0

[ PFIR ] Idiots on Canadian Supreme Court demand right of GLOBAL Google censorship!
by My 02 Jul '17

02 Jul '17

> grarpamp grarpamp at gmail.com > Thu Jun 29 14:17:24 PDT 2017 > > DMCA torrent results, limiting advertising, > throwing captchas, etc... > it's a useless space to many already. > You forgot their javascript shilling campaign intended to subvert and replace html: When you have eliminated the JavaScript, whatever remains must be an empty page. "" maps.go ogle.com

1 0

defense against impugning of character?
by Sharky 02 Jul '17

02 Jul '17

> Cecilia Tanaka cecilia.tanaka at gmail.com > Fri Jun 23 22:38:11 PDT 2017 > > Trump is orange > ugly fake tan > Victim of political comedy, seems. Of fake news. Pic related. twitter.com/realDonaldTrumpstatus/881503147168071680 > I would always be the Red Power Ranger > You want to be (mostly) "white" ? > LGBTQWERTY Supremacy > 'Lesbian' is a category of 'Gay'. 'Gay' is newspeak for same-sex love but has an actual, different definition. 'Transitioning' biological sex is impossible, less you are a frog. As a (((lawyer))) you should be appalled by the inaccuracy of these labels. > I am still pretty white > The Japanese are the "whites" of Asia. Be careful c&c anon.

1 0

[sdmaclean@gmail.com: [antlr-discussion] Recent presentation on using ANTLR in cybersecurity]
by Zenaan Harkness 02 Jul '17

02 Jul '17

May be of interest to some. ----- Forwarded message from Stuart Maclean <sdmaclean(a)gmail.com> ----- From: Stuart Maclean <sdmaclean(a)gmail.com> To: antlr-discussion <antlr-discussion(a)googlegroups.com> Reply-To: antlr-discussion(a)googlegroups.com Date: Fri, 30 Jun 2017 17:55:47 -0700 (PDT) Subject: [antlr-discussion] Recent presentation on using ANTLR in cybersecurity I recently presented ANTLR-centric work at my local Java User Group, and the slides are available should anyone be interested.The first three quarters of the material essentially expands on Parr's Antlr Definitive Ref book, i.e. the Expr language and different grammars for it: plain, with embedded actions, producing trees, etc. The last part of the material explains how I was able to auto-generate C source code using ANTLR trees, for work in dynamic program analysis. The main site is seajug.org with my slides available at http://www.nimret.org/seajug/past/2017/jun/slides.pdf Stuart

1 0