September 2017 - cypherpunks - lists.cpunks.org

Improve Cybersecurity Above Export Grade
by Ryan Carboni 18 Sep '17

18 Sep '17

Unfortunately, improving cybersecurity seems to conflict with Tor project's idea of making the Internet of Things secure. But these two essays from knowledgeable individuals are likely to be forgotten and ignored. Doing nothing is to say you want what happens to continue. I mean, a big deal was made over EFF's "well under US $250,000" DES Cracker. So let's set export grade cybersecurity at $250,000. But programming hours aren't free. How do so many liberal groups make money? How do you get others to do what you want? There are industries with actual NDAs, and prices still get estimated and posted by consultants on their blogs. Zerodium literally posts the prices. Anyway, Robert S. Litt is a pathological liar when he vouched for DES. Got promoted to the ODNI General Counsel, who went on to give advice to Clapper on lying. No one is going to condemn him. The FTC sued ASUS for insecure routers. Force these companies to use OpenWRT (or some other project) with strong default settings. Someone has to force them. Yeah, yeah. I top posted. https://www.reddit.com/r/technology/comments/70tvpi/ccleaner_compromised_to… My boss/es flipped their lid when I made the decision to use Defender with > removing admin rights to basically all the users. We have basically > eliminated all previously known infections and have been (in theory) virus > free for about 14 months now. > Match that and filter out traffic to ports 25, block 21/22/23 and > 6666-7000 and you've prevented most bot and ransomware attacks. > If you can have your IT policy setup to organize GeoIP restrictions, you > can then limit the amount of potential attacks from foreign states (as long > as they aren't trying from one within your country) > It's all about trying to prevent as much as you can without affecting your > users' workloads. > Edit: Obligatory; I am not a security expert/analyst. I run systems. I > protect systems. I have to work with what the company offers and sometimes > that means taking risks. Port blocking, GeoIP restrictions, firewall > configurations, removing admin rights to users, limiting access to certain > devices, locking out USB devices, preventing computers from booting to > PXE/USB/CD, keeping physical locks on cabinets, gathering data from system > logs and other components such as IDS and firewalls, analyzing outbound and > inbound traffic, running exploit verification through compliance policies, > etc etc. There are but a minor few things you can do to help maintain, > secure and generally adapt your network to all the ongoing cyber threats. > There are reasons why you hear of things like Equifax and the Ministry of > Health being hacking targets and not being prepared. But that's just it, > better be prepared for one or two things than regret never having learned > about them until after. > My tl;dr is this: if you're worried about your antivirus not doing much, > you are validated. Microsoft Defender has just as much luck keeping you out > of trouble than most other solutions, but it's free. Remember: if something > that is too good to be true, probably is. Be safe and watch what you click. https://web.archive.org/web/20151106172427/https://grsecurity.net/~spender/… I see security as being more of a nuisance for the upstream kernel > developers. It's understandable, if someone makes a mistake, it can be > embarrassing, particularly when it gets into the news or has some > important impact. It also lessens the image of Linux as being an > enterprise-ready OS if someone can write up an exploit to take over the > entire system in a matter of hours in some cases. > I don't think they get the same kind of enjoyment as I do out of > securing things, eliminating exploit vectors and entire bug classes. So > their approach seems to be in line with the feeling of it being a > nuisance: when a vulnerability appears and they discover it or it's > reported to them, they'll fix it and simply move on. > The industry is entirely broken in terms of what it values. Bug > bounties, pwn2own etc. Millions of dollars have been paid out just to > fix individual bugs, but the cornerstones of modern exploit prevention > created by the PaX Team have been rewarded with no money at all by the > industry. It rewards what perpetuates the problem, and people looking > to make money stand in line waiting for whatever new handout the > industry's created for itself. If you want to see how perverse the > incentives are, just look at us: we don't make enough to do our work > full time, it's not enough even for a single person to survive on. > People will only pay for what they can't get for free, so they'll pay > for a bug or they'll pay for an exploit, but they won't pay to support > the people creating the technology that make that bug and that exploit > irrelevant. > The upstream developers have strong opinions of their own, but I think > they're a bit misguided. For a long time (probably even currently) > they've essentially blamed the circus aspect of the industry as being > the reason why they're not taking security more seriously -- as it would > lend some credibility to a view different from their own that bugs are > just bugs. They play a strange game where on the one hand, they have a > security(a)kernel.org email address to be privately notified of security > vulnerabilities, but their public stance is that security > vulnerabilities shouldn't be treated differently from any other bug: > "bugs are bugs". What leads from this claim is that everyone should be > running the very latest version of Linux, as that's the only way to > ensure you have all the fixes, security or not. Unfortunately, the > latest versions of Linux also come with the most vulnerabilities, > usually introduced in newer code as their development model for the past > several years has resulted in rapid inclusion of experimental code of a > period of two months, after which it's declared "stable." > Unfortunately, it's not stable enough so unlike the old development > model where there was a stable tree that users and distros used, and a > development tree the kernel developers hacked away on for much longer > periods of time, now there's much more fragmentation of Linux. If you > go on kernel.org, you'll notice 8 "stable" kernel versions -- there are > many more than that being widely used (for instance, Canonical maintains > some), but those are the only ones they allow to be listed on > kernel.org. For some reason, the -stable maintainer Greg Kroah Hartman > has some beef with Canonical, so he refuses to allow their kernels to be > listed on the site -- he doesn't consider them to be part of the kernel > community. > So this leads into another problem, all these different stable kernels > leads to lots of duplication of effort -- a security fix in the latest > version of Linux will likely need to be backported through several years > of stable kernels. Even more problematic is that the majority of kernel > developers have a stated policy of avoiding clear mention of security > issues in their commit log messages, the exact information needed for > everyone to backport important security fixes. So in a way the kernel > developers are avoiding responsibility for the security of their code. > They present an impossible solution: (use the latest version of Linux, > which has the most vulnerabilities and unstable, untested features) and > anyone not doing that then has to rely on their particular Linux > distribution to provide them with fixes. > I've been pretty vocal about this, but I've been surprised that people > simply don't care (other than a small minority of security-conscious > people). Maybe patching vulnerabilities after they're discovered is the > only model of security they can grasp or the only one they've been > exposed to. No news article is ever going to talk about how we > prevented many critical Linux vulnerabilities this year without having > to know anything about the individual bugs themselves. The article will > always be about the imminent danger of the vulnerability and the need > for swift patching. > There's no real leadership in Linux as far as security goes from within > the kernel community itself. Microsoft can force their employees to > take training on secure coding practices and common bug classes. > Something like that has never happened for Linux -- modulo demands from > their respective employers (or perhaps now organizations like the CII > which in turn will have to give them money), no one is any position to > get them to work on anything or improve their skill in anything other > than the particular subareas they're interested in. When I presented at > the Linux Security Summit in 2010, run concurrently in the same building > with Linux meetings on other topics, the only people in the audience for > all of the security talks were developers working on the access control > frameworks in Linux. I had met another kernel developer in the hallway > and asked if he'd be attending the security topic, and he (the main > filesystem developer) was obviously only attending the filesystem > conference running at the same time. Yet this same developer could > probably learn a lesson or two about why it's a bad idea to introduce > complex changes with single-line commit messages, several times > introducing vulnerabilities in the process (which were later fixed with > similarly undescriptive single-line commit messages). > So this goes back to the issue of people not caring when I point out the > problems with Linux security. Maybe it's because I have no right to > complain about anything someone is contributing for free? It would > likely upset me as well. Perhaps the only important difference here is > that many of these developers are being paid full-time salaries to > create their code -- it's their day job. It's for this reason that I > think the only shift will end up happening via initiatives like CII > where the respective employers for the kernel developers essentially > tell them the time for ignoring security is over, they want them to > actively work on some fundamental improvements instead of simply fixing > bugs as they're discovered. It's interesting that Linus recently gave > an interview > ( > http://www.eweek.com/enterprise-apps/linus-torvalds-talks-linux-security-at… > ) > where he started off with his old statement he's repeated many times > about security simply being about bugs. He then followed it up with > something that sounded very similar to what our approach has been for > years: "The only real solution to security is to admit that bugs > happen," Torvalds said, "and then mitigate them by having multiple > layers, so if you have a hole in one component, the next layer will > catch the issue." The problem is that Linux has never really had another > layer, it's been a single layer of the typical bug/patch cycle. They've > had every opportunity to change that situation, but the prevailing naive > view has been: "why introduce some performance hit for a case we should > never hit, as long as our code is correct? Let's just make sure our > code is correct, then we don't need all this extra cruft." They've > never really accepted that different users have different priorities, > and some would be more than happy to give up some small amount of > performance (we're talking single digits here) in exchange for a host of > preventive security measures that will save them countless times against > common bug classes and exploit vectors, where these security features > are completely configurable for those who value performance above all > else. Linux has instead simply waited for Intel to implement security > features of the PaX Team in silicon, in practice up to 9 years after > it's been possible via software.

1 0

[MINISTRY] facts must not be aired/ discussed publicly - cultural death of a nation/ USA
by Zenaan Harkness 18 Sep '17

18 Sep '17

Some will applaud the toppling of (in PC-speak) "White Supremacist" statutes, the renaming of streets and the banning of cultural 'historical' movies such as Woodrow Wilson's "terrible truth" as he named/ commented on the movie "Birth of a Nation" - a breakthrough 3-hour "historical" in 1915! - which can no longer be aired in "the land of the free, home of the brave". The cotton-wool brigade has taken over America, and perhaps the majority acquiesce in an unspoken submission to "assumed historical guilt" or some such rubbish. Although facts will undoubtedly support the "assumed historical guilt" perspective, I call it rubbish because the individual in a community has a duty to live his own life, and support his current community whilst being the greatest he or she they can be - this is primarily a duty to oneself, and there can be little but madness in the burial of, essentially a fervent attempt to deny, one's actual past! How can our grandchildren learn from the mistakes of our grandfathers when we erase our history from our shared collective consciousness? Logic (and facts!) of course never convinced the majority... Good luck fellow humans, http://russia-insider.com/en/politics/americas-pc-plague-national-catastrop… ... The cinema’s turn has now come. Now, the brilliant movie "Gone with the Wind" runs the risk of disappearing from all American screens. The Memphis precedent will work. And they will certainly never ever show one of the first US full-length films, "The Birth of a Nation," directed by David Griffith, who, by the way, is considered the father of American cinema. It was he who laid the foundations for sensible editing and even special effects. "Birth of a Nation." 1915. Three hours. The historical period the movie was set in was the Civil War in the US and the events immediately after. The film had unprecedented battle scenes for cinema of that time. The drama lay in a gripping account of a fratricidal war and the drama of the defeated where "the White South was crushed by the Black heel of the North." Without regard to rules of war and decency. The North unleashed Black brutality on the Southern Whites in the name of revenge for the past. How can this film be shown now, especially since the birth of the awful Ku Klux Klan is also realistically depicted in the movie as well? It emerged as a necessary organization for the self-defense of Whites. And, the cavalry charges while "Ride of the Valkyries" by Wagner is playing as the score. All of this is unacceptable now, so this picture will be permanently banned from American cinemas. All of this even though the US President, Woodrow Wilson, who was a Nobel Peace Prize recipient, but who was also considered an authoritative historian, called the film "Birth of a Nation" a "terrible truth." ...

1 0

Why I can't sleep soundly with blockchain, being the cypherpunk
by Sergey Matveev 17 Sep '17

17 Sep '17

Greetings, fellow cypherpunks! There is so much hype about blockchain technologies! Everyone is fascinated about it, dream about wonderful bright cryptofuture, and stops talking with me, when hears that I do not find blockchain either interesting or useful. Why I do not like blockchains? Actually *if they would work*, from cryptographic point of view, then I have nothing against! Distributed trusted databases, timestamps and consensus making are great things to deal with. But unfortunately I see that at least Bitcoin (the biggest blockchain in use) has already failed without human-initiated regulations[0]. It failed from *cryptographic* point of view. I am cypherpunk and I am very interested and excited about cryptography subjects. Why? Because all of that is based on math and assumptions about practical impossibility of reverting many functions (you know, some kind of "2^100 of operations are required for ..."). It is valuable because you do not have to trust and rely on people *at all*. Well, except for cryptographers and similar scientists. People are the problem #1 in all security questions. They can be bribed, all of them have their price. They are error-prone, not reliable, lie and misbehave easily. I can not sleep soundly, knowing that I depend on some human. Cryptography world gives unbelievable possibility to eliminate them! If I can easily remember relatively long passphrase (100-120 characters in practice) as a key to proven strong authenticated encryption algorithm, then I am confident that my data is safe. I can use eavesdropped links and virtually any potentially vulnerable storage when cryptography is applied correctly. While noone ever know if quantum computers powerful (big) enough will be built, RSA/ElGamal/ECC stay pretty safe too. I really love the fact of security risks estimation possibility, based on current technology state and progress. People can fail you anytime -- only *hope* will keep you calm. Are you afraid of algorithms breaking possibility? Even one of the first encryption algorithm used in computer era -- DES, is still useful and secure enough in 3DES composition. If you are still frightened, then learn from soviets: their GOST 28147-89 block cipher[1], created in 1970s, still has more than 2^200 security margin. Who the hell knows what "key meshing"[2] means? But that block cipher has that kind of thing, making it immune to Sweet32 attack, appeared dozens of years after. Do not overestimate value of performance, by sacrificing its security -- perfect advice for sleeping well for years. But what about blockchains? Citing Ethereum's "problems" wiki page[3]: While a cryptographer is used to assumptions of the form "this algorithm is guaranteed to be unbreakable provided that these underlying math problems remain hard", the world of cryptoeconomics must contend with fuzzy empirical factors such as the difficulty of collusion attacks, the relative quantity of altruistic, profit-seeking and anti-altruistic parties, the level of concentration of different kinds of resources, and in some cases even sociocultural circumstances. Everything is right here. Anyway you *will* depend on people, society, its behaviour and huge quantity of empirical factors and assumptions. It is not cypherpunk's reliable and risks-predictable world -- it has nothing in common. Replacing the need to trust the human, with the need to trust the algorithm and technology -- that *is* the exact reason why I am interested in crypto. Requiring and depending on society again -- that is the exact reason why I standing aside from blockchains. They do not offer any guarantees[4], but likelihoods, lottery. Cypherpunk must rely and depend on people as little as he can. Remember cypherpunk's manifesto[5] -- spread as little unnecessary information as possible, because people *will* find ways how to harm you with it. And blockchains are broadcasting permanent storages, where most of them (with Zcash[6] exception for example) give you neither privacy nor anonymity for your personal (private) transactions. [0] https://en.wikipedia.org/wiki/Ghash.io#51.25_attack_controversy [1] http://gost.cypherpunks.ru/en2814789.html [2] http://gost.cypherpunks.ru/enMeshing.html [3] https://github.com/ethereum/wiki/wiki/Problems [4] https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoculture [5] https://www.activism.net/cypherpunk/manifesto.html [6] https://en.wikipedia.org/wiki/Zcash -- Sergey Matveev (http://www.stargrave.org/) OpenPGP: CF60 E89A 5923 1E76 E263 6422 AE1A 8109 E498 57EF

9 14

Fwd: Newsletter Autistici/Inventati - Server compromessi | Breach in A/I servers
by Razer 17 Sep '17

17 Sep '17

-------- Forwarded Message -------- Subject: Newsletter Autistici/Inventati - Server compromessi | Breach in A/I servers Date: Fri, 15 Sep 2017 17:03:30 +0000 (UTC) From: Autistici/Inventati <info(a)autistici.org> Reply-To: info(a)autistici.org To: rayzer(a)riseup.net ++++++++++++++++++++++++++++++++ SERVER COMPROMESSI Niente panico, ma cambiate le password ++++++++++++++++++++++++++++++++ BREACH IN A/I SERVERS Don't panic, but change your passwords ++++++++++++++++++++++++++++++++ VIOLACION EN LOS SERVIDORES Ningun panico, pero cambia tus contrasenas ++++++++++++++++++++++++++++++++ [English version below] [Version en Espanol mas abajo] **Stai ricevendo quest'email perche' hai un account o gestisci una lista o una newsletter nei server di Autistici/Inventati** Ieri, giovedi' 14 settembre, abbiamo scoperto che qualche giorno fa l'account di un amministratore e' stato compromesso. Appena ce ne siamo resi conto, abbiamo cominciato immediatamente a lavorare per risolvere il problema. Abbiamo gia' realizzato le mitigazioni necessarie e siamo riusciti nuovamente a rimettere tutto in sicurezza. Sono ancora in corso analisi dei log e la reinstallazione dell'infrastruttura. Stiamo analizzando i dettagli della situazione per sapere esattamente che cosa e' successo. Data la natura dell'intrusione, potenzialmente tutti i dati degli utenti sono stati accessibili agli intrusi, ma al momento non abbiamo prove del fatto che siano state toccate delle caselle di posta. Come misura di sicurezza minima, dovresti cambiare tutte le tue password, e le domande di recupero dei tuoi account (email, webdav, lista di email e newsletter, noblogs.org) Ti consigliamo di usare una password forte: <https://www.autistici.org/docs/mail/passwd_safe>. Inoltre raccomandiamo sempre caldamente, se non lo hai ancora fatto, di attivare l'autenticazione a due fattori (2FA) per tenere il tuo account piu' al sicuro: <https://www.autistici.org/docs/2FA>. Nel caso l'autenticazione 2FA fosse gia' stata abilitata, dovrai resettarla, disattivandola e riattivandola. Se ne hai la possibilita', scarica sempre i messaggi di posta sul tuo computer, conservandoli con la dovuta cautela, invece di lasciarli sui nostri server. Inoltre per maggior sicurezza ricorda sempre di crittografare le tue comunicazioni: * email : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://www.autistici.org/docs/jabber/otr> Collettivo A/I. * * * [English version] **You are receiving this email because you have an email account and/or you manage a mailing list or a newsletter on Autistici/Inventati servers** Yesterday, on Thursday 14 September, we found out that a few days ago an admin account had been compromised. As soon as we spotted this intrusion, we immediately got to work for solving the problem. We have already taken the necessary mitigation measures and have secured the machines. We are still analyzing logs and reinstalling the infrastructure. We are examining the details of the situation to figure out what happened exactly. Given the nature of this intrusion, all users' data might have potentially been accessed by the intruders, but so far we have found no evidence that someone touched the mailboxes. As a minimum security requirement, you should change all your passwords and the recovery questions for your accounts (email, webdav, mailing lists and newsletters, noblogs.org) We recommend to create strong passwords for this: <https://www.autistici.org/docs/mail/passwd_safe>. We also strongly suggest, if you haven't done so already, to activate 2-factor authentication to secure the access to your account: <https://www.autistici.org/docs/2FA>. If you have already enabled 2-factor authentication, you should reset that too, by deactivating it and activating it again. If you can, always download your email messages to your personal computer, storing them with care, instead of keeping them in our servers. Also, remember to secure your communications by encrypting them: * email : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://ssd.eff.org/en/module/communicating-others#4> A/I Collective * * * [Espanol] **Recibes este correo porque' tienes una cuenta de correo y/o gestionas una lista de correo o una newsletter en los servidores de Autistici/Inventati** Ayer, jueves 14 de Septiembre, hemos descubierto hace unos dias que una cuenta de administracion de nuestra infraestructura habia sido violada. En cuanto nos hemos dado cuenta hemos empezado a trabajar para resolver el problema. Hemos tomados las medidas de mitigacion necesarias y hemos puesto en seguridad las maquinas. Estamos todavia analizando los logs y reinstalando la infraestructura. Estamos tambien examinando los detalles de la situacion para averiguar lo que ha ocurrido. Dada la naturaleza de la violacion, los intrusos han tenido acceso a todos los datos de los usuarios, pero en este momento no tenemos pruebas de que hayan tocado las cuentas de correo. Como medida minima de seguridad, tienes que cambiar las contrasenas y las preguntas de seguridad de todas tus cuentas (email, webdav, listas de correo y newsletters, noblogs.org) Te recomendamos de crear contrasenas fuertes: <https://ssd.eff.org/es/module/creando-contrase%C3%B1as-seguras>. Tambien te recomendamos, si no lo has hecho todavia, activar la autenticacion de dos factores (2FA): <https://www.autistici.org/docs/2FA>. Si ya tenias la autenticacion de dos factores habilitada, tendras que resetearla, deshabilitandola y volviendo a habilitarla. Si puedes, descargate siempre los mensajes de tu correo en tu ordenador personal, y guardalos con cuidado, en vez de dejarlos en nuestros servidores. Tambien recuerdate de cifrar tus comunicaciones: * correo : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://ssd.eff.org/es/module/comunic%C3%A1ndote-con-otros> Colectivo A/I ++++ 15 September 2017 Autistici-Inventati Collective http://www.inventati.org http://www.autistici.org donate: http://www.autistici.org/donate

1 0

Fun Hardware :)
by grarpamp 16 Sep '17

16 Sep '17

On Wed, Sep 6, 2017 at 10:15 PM, Cecilia Tanaka <cecilia.tanaka(a)gmail.com> wrote: > PS for grarpamp: - "Despacito" played on two calculators, hihi! > Pretty cute and will make you smile a bit! <3 > > # https://youtu.be/gBT5lmikXrs Unboxing the "Clariton" AR-7778 Electronic Musical Calculator Complete with catchy music track https://www.youtube.com/watch?v=NBGXlxUIxuI Various models available https://world.taobao.com/item/521983057248 https://www.englishtaobao.net/Product/521983057248 https://www.amazon.co.jp/dp/B01N7GT3S2 Some tablatures for them are starting to show up. Needs a line level sub output so you can bump it. And of course, more tunes... https://www.youtube.com/channel/UCbvQHCZJHHS4PJpatQGH-0w/videos Casio and Sharp rivalry used to make similar things decades ago when pocket calculators and Japan first hit big... https://www.ebay.com/sch/i.html?_nkw=musical+calculator Related... https://www.ebay.com/sch/i.html?_nkw=nintendo+game+watch > ------- > "Don't let anyone rob you of your imagination, your creativity, or > your curiosity. It's your place in the world; it's your life. Go on > and do all you can with it, and make it the life you want to live." - > Mae Jemison

1 0

Forget populism – crypto-anarchists are the new masters
by grarpamp 15 Sep '17

15 Sep '17

https://www.theguardian.com/technology/2017/jun/04/forget-far-right-populis… Many are concerned about the internet’s role in politics. But more worrying is the digital tsunami poised to engulf us, as machine intelligence and a rising tech elite radically restructure life as we know it ......... Consider for a moment how your life has changed thanks to digital technology. You can become friends with 2 billion connected people, chose your own news, and watch/date/order whatever you want, on demand. Infinite choice and control is now the norm, and yet formal politics has barely evolved since the days of Robert Peel. Our modern political system came of age in the industrial revolution, which was a time of massive organisations and centralised control. We are now, however, firmly in a new industrial revolution, characterised by endless choice, digital technology, data, automation and artificial intelligence. The economy, identity, political allegiances, perhaps even the essence of what it is to be human, are all starting to change, and our politics will have to change with it. The current set-up, including the populist right, will cling on for a while, like a legacy IT system that’s too pricey to update, but it will shortly become redundant. Crypto-anarchy is taking over the world – millions now unwittingly rely on it for online security So what else might follow? In October last year, while researching my new book, Radicals, I was invited by a Slovenian hacker in his late 20s called Pavol to a place called Parallel Polis, a three-storey building in Prague that includes a 3D printer workshop and the “Institute of Crypto-Anarchy”. Crypto-anarchists are mostly computer-hacking, anti-state libertarians who have been kicking around the political fringes for two decades, trying to warn a mostly uninterested public about the dangers of a world where everything is connected and online. They also believe that digital technology, provided citizens are able to use encryption themselves, is the route to a stateless paradise, since it undermines government’s ability to monitor, control and tax its people. Crypto-anarchists build software – think of it as political computer code – that can protect us online. Julian Assange is a crypto-anarchist (before WikiLeaks he was an active member of the movement’s most important mailing list), and so perhaps is Edward Snowden. Once the obsessive and nerdy kids in school, they are now the ones who fix your ransomware blunder or start up unicorn tech firms. They are the sort of people who run the technology that runs the world. ..... A representative from something called “Bitnation” explained to Parallel Polis how an entire nation could one day be provided online via an uncontrollable, uncensorable digital network, where groups of citizens could club together to privately commission public services. ........... At some point, and probably sooner than we think, the current left and right offerings of the major parties, including (perhaps especially) the populist, will start to appear ludicrous and unworkable. New political movements and ideas will arrive before long for this industrial revolution, especially once the majority of the population will soon have grown up online. It will be a politics that offers solutions to the challenges society will face, and be bold enough to steer technology rather than be led by it, to harness it rather than dismiss it, to see it as a motor of social change, not just a job maker. Perhaps there will be some back-to-the-earth, off-grid thinking reminiscent of the 1970s. (There are already small hints of it if you look in the right places: bricks through Google bus windows and digital detox days). I’m not sure. More likely is that groups like the Prague crypto-anarchists, who will embrace the changes and experiment with entirely new forms of governance and society, will emerge. After all, they were right about digital technology, about surveillance and bitcoin and most of us ignored them. And for better of worse, I think they’re probably right about this too.

2 1

Re: [tor-talk] $1,000,000 for tor zerodays
by grarpamp 15 Sep '17

15 Sep '17

On Fri, Sep 15, 2017 at 5:33 AM, eric gisse <jowr.pi(a)gmail.com> wrote: > https://motherboard.vice.com/en_us/article/wnjgxb/russia-has-put-a-bounty-o… > > On Thu, Sep 14, 2017 at 5:17 PM, flipchan <flipchan(a)riseup.net> wrote: >> Where does the cash come from? Governments, Intel, LE, some corporate types, dark secrets and money. The ones, and compartmented parts of them, that need more exploits than their current, often parallel, capabilities and efforts already have. And a likely lesser set of users / devs that simply need to know [sooner]. Perhaps $1M worth bought on markets globally every month. https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

1 0

Barrett Brown Pursuance Project AMA and AltGov Manifesto
by grarpamp 15 Sep '17

15 Sep '17

https://motherboard.vice.com/en_us/article/gyynwm/barrett-brown-what-is-to-… https://www.youtube.com/watch?v=SOoPyovqk2Q https://pursuanceproject.org/ It is time to consider alternate systems of governance. Impactful, agile, secure civic collaboration The Barrett Brown Review of Arts & Letters & Civil Strife is written monthly by Barrett Brown, winner of the 2016 National Magazine Award for columns and commentary. Selections... The pursuance system is the world's first comprehensive framework for process democracy. That is, it allows individuals with no prior relationship to self-organize into robust, agile entities governed via a "proceduralism of agreement." These entities, called pursuances, in turn engage and collaborate among themselves to whatever extent they choose, leading ultimately to a vast and formidable ecosystem of opposition to institutionalized injustice. Over 40 years ago, a vastly criminalized presidential administration was brought down through a combination of leaks, reporting, and Congressional action. Twenty-five years later, two former Nixon administration officials, Donald Rumsfeld and Dick Cheney, managed to take firm control of yet another presidential administration. This one, too, was marked by revelations of unconstitutional and criminal acts, including torture, mass surveillance, the unprecedented negligence of emergency preparedness functions, the politically motivated firings of U.S. attorneys, and the most disastrous military engagements since Vietnam. Ten years later, many now regard the Bush Administration with actual nostalgia. It has become more and more difficult, as the years proceed, to maintain the fiction that the American republic is fundamentally sound. An associated myth—that the great majority of the American electorate are decent people who are entirely capable of overseeing the single most powerful apparatus in history—has also become less viable. The "establishment," as we may as well join in terming it, has likewise lost credibility, for reasons ranging from nonsensical to inarguable. The end result is a crisis of moral authority, and even of amoral authority; this is a society that cannot even produce a proper strongman. But it can certainly produce a disaster, for ourselves and for the world. Recall that the baseline of 21st century America involves a sort of constitutional police state with unprecedented incarceration rates, increasingly militarized law enforcement, an unaccountable intelligence community with a long history of unconstitutional behavior, and a judicial and legislative culture that, all told, has officially rendered tens of millions of Americans criminals Rumsfeld understood the real lesson of Watergate: the risks of violating our Constitution are vastly eclipsed by the rewards. The consequences of a morally failed American republic, continuing on its present course for even just another decade, would be irreparable. No competent observer of our current trajectory can today disregard this scenario, or others far worse. Years ago, I created a group called Project PM, billed as a "distributed think tank" and intended to build a platform for vastly improved civic collaboration and media analysis. The most important fact of the 21st century is that any individual can now collaborate with any other individual on the planet. It is an absolute certainty that, with sufficient thought, a new mechanism may someday be designed, capable of integrating thousands of talented individuals and existing organizations into a sort of parallel civic ecosystem Since my release from prison eight months ago, the Pursuance System has been explained in broad terms via outlets like Wired; it will be detailed further in broadcasts by NPR, PBS, and VICE, as well as the upcoming documentary Sensational. This media push will culminate next year with the publication of my upcoming book, a "memoir-manifesto" that will make the larger case for why the Pursuance System is not only necessary, but inevitable.

3 4

Govts Feds Sponsor $1M for Tor Zerodays
by grarpamp 15 Sep '17

15 Sep '17

> On Sep 13, 2017, at 8:41 AM, I <beatthebastards(a)inbox.com> wrote: > https://zerodium.com/tor.html For more information about our tailored cybersecurity capabilities for governments or our protective solutions for corporations, please contact us. Access to ZERODIUM solutions and capabilities is highly restricted and is only available to a very limited number of eligible customers. jackieam2003 This is one of the reasons why we need tor browser to be sandboxed, it would make it much harder for an attacker to find two separate zero days, to get past both Firefox and the sandbox. That is generally Qubes+Whonix. On Thu, Sep 14, 2017 at 11:08 AM, Jim Carter <rudrajohn.rs(a)gmail.com> wrote: > Someone please take down that website. > > On Thu, Sep 14, 2017 at 10:38 AM, Lara <lara.tor(a)emails.veryspeedy.net> > wrote: > >> On Thu, 14 Sep 2017, at 04:35, krishna e bera wrote: >> > Anyone caught selling Tor bugs and exploits to anyone but TorProject >> > should be subject to some kind of severe penalty. It is an offence >> > against the right to privacy, in other words a crime against humanity. >> >> You have spoken so well, comrade! The People's Tribunals should judge >> harshly this sort of crime against our fellow comrades. And the Chief >> Administration of Corrective Labor Camps should make sure they are doing >> steady jobs to repay the public for their crimes. >> >> Than the people will need internal Passports. And should identify so the >> government will know who the criminals are. And finally everyone should >> be monitored by qualified agents to make sure nobody violates this >> sacred right to privacy. >> >> Once one single country starts doing that, more will follow. I am sure.

1 0

Godaddy survey answers
by Zenaan Harkness 15 Sep '17

15 Sep '17

Godaddy's in-house survey monkey just hit me up. Thought it was a good time to express their lack of advising themselves in regard to the impact to their public image when they took a stand against TDS: - Why did you rate Godaddy the way you just did (low)? Godaddy took a stand against freedom of speech in rejecting TheDailyStormer.com's (TDS) domain registration, and GoDaddy did so in a way which failed to uphold one of our community's foundational freedoms. When undermining a fundamental human right, as Godaddy did to TDS, even if your target is speaking objectionably, Godaddy as an "information carrier" (of sorts) has a significantly higher duty of care to its customers (e.g. TDS) than other entities. Godaddy, in cancelling TDS' domain, failed to conduct itself in a way compatible with its duty of care obligations to our community to treat every body fairly and in a way which preserves due process. Godaddy should advise itself to inform itself of the requirements for conduct in relation to those of its customers who say things on their websites which Godaddy may object to. - What is the single most important thing we could do to improve your experience? Advise yourself that when you take a public stand against freedom of speech (even objectionable speech), you are affecting your reputation negatively, in a big way. Due to the TDS episode, my plans are to transition completely off of Godaddy in the coming 2 years.

10 29