April 2019 - cypherpunks - lists.cpunks.org

Shirt! Trump -did- collude with Russia - Caitlin Johnstone apologizes in detail‼ - OMFG I can't believe I'm writing OMFG! - [PEACE]
by Zenaan Harkness 03 Apr '19

03 Apr '19

Dudes and dudettes, we'iz shawked we tell ya, shawked! Serious shirtz dis, serious shirt! Johnstone: Leaked '401'-Page Mueller Report Proves Barr Lied, Collusion Theorists Vindicated https://www.zerohedge.com/news/2019-04-01/johnstone-leaked-401-page-mueller… https://medium.com/@caityjohnstone/leaked-mueller-report-proves-barr-lied-c… An unredacted copy of the Robert Mueller report has been leaked to theWashington Post, who published the full document on its website Monday. The report contains many shocking revelations which prove that Attorney General William Barr deceived the world in his summary of its contents, as astute Trump-Russia collusion theorists have been claiming since it emerged. For example, while Barr’s excerpted quote from the report may read like a seemingly unequivocal assertion, “[T]he investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities,” it turns out that the full sentence reads very differently: “It is totally not the case that the investigation did not establish that members of the Trump Campaign conspired or coordinated with the Russian government in its election interference activities.” The following sentence is even more damning: “It definitely did establish that that happened.” …

1 0

Fwd: How Russia tampers with GPS
by coderman 03 Apr '19

03 Apr '19

1 big thing: How Russia tampers with GPS Illustration: Aïda Amer/Axios Satellite navigation systems like the Global Positioning System (GPS) make so many different pieces of our global infrastructure tick that most countries treat their signals as sacrosanct, knowing that interfering with them could have devastating effects. But a [new report](https://link.axios.com/click/16391119.5976/aHR0cHM6Ly93d3cuYzRyZXBv… released Tuesday is giving us the first broad view of a country — Russia — that's pervasively tampering with the service. The big picture: Global navigation satellites — including GPS and less-used competing services like Russia's GLONASS — are coordinated networks of atomic clocks in outer space that can be used to triangulate precise locations or coordinate precise timing. Without them, everything from global shipping to financial markets would suffer. Why it matters: It's easy to see the military, transportation and pizza delivery importance of precise location information. The timing signals are extremely important, too. - The stock market needs precision timing to handle transactions down to the fractional second. - Precise timing is a critical component in telecommunications because it allows national and international networks to synchronize. The intrigue: Russia has been called out several times before for interfering with global positioning satellite systems, and it is known to capitalize on interfering with GPS for military and national security purposes like no other country. But before the [study by the C4ADS](https://link.axios.com/click/16391119.5976/aHR0cHM6Ly93d3cuYzRyZXBvc… think tank, no one had really taken a scientific look across all of Russia's activities to see how constant the disruptions are. - To do that, C4ADS used University of Texas equipment placed on the International Space Station to monitor more than 9,800 suspected instances since 2016 where fraudulent global navigation signals appear to have been broadcast in the Russian Federation, as well as instances where similar signals were broadcast in Russian conflict zones like Crimea and Syria. C4ADS is not formally accusing the Russian government of being behind any of the fraudulent, "spoofed" signals. It would be impossible to make that kind of determination from the space station. But, but, but: It is clear that many of the instances largely serve Russian national interests. - In Russia, C4ADS found that several spoofed signals came from areas where Russian VIPs (like President Vladimir Putin) were traveling or that contained military or domestic facilities Russia wants to protect (including a "multimillion-dollar 'palace'" reportedly built for Putin). - Those areas broadcast the coordinates of airports in places where there are no airports. - The spoofing was frequent enough that C4ADS reports the Russian internet firm Yandex had to redesign its ride sharing app. Otherwise, it billed passengers for sudden trips to the airport whenever their driver passed through a spoofed area. - Airports that mysteriously seemed to appear in the Black Sea were so disruptive that the United States issued a warning to international cargo firms. Why airports? Many manufacturers of drones use GPS chips to prevent their products from flying into airport airspace. C4ADS suspects the spoofing was to prevent drone attacks or surveillance. Meanwhile, Russia also used spoofing in combat zones, particularly Syria, to try to limit attacks against its installations. Go deeper: [Read more, including how Moscow uses GPS hacking in battle](https://link.axios.com/click/16391119.5976/aHR0cHM6Ly93d3cuYXhpb3Mu….

2 3

Crypto Network HW Links, Anti Vampire and Sybil Nets, Actors Everywhere
by grarpamp 03 Apr '19

03 Apr '19

> If the state is out to get you I'd just assume that everything arround you > is rooted and a wire tap and act accordingly. Doesn't have to be anyone doing anything wrong. Anyone following geopolitics knows that surveillors can reap just aggregate spying and turn that into realtime influence messaging to their own purpose. "Looks like a lot of overlay users are visiting a node known for artwork. Let's craft on that." "Cryptocurrency rising... Let's craft that." "Here's todays daily statistical and Markov report... Craft it." > assume that everything arround you is rooted and a wire tap Is this not entirely possible for all users of technology around the globe today? Snowden and everyone else before and since told you that you're all being tapped, datamined, controlled, and used. But most still don't believe it, or do anything to directly end it, all you do is drop some tools, while leaving all the taps, entities, activities, policies, still in place. Oops. Recall that you have all still started up exactly ZERO projects that are combining all these elements... #OpenFabs , #OpenHW , #OpenSW , #OpenDev , #OpenBiz , #OpenAudits , etc So you still clearly have zero knowledge of what's actually in your CPU's, your NIC's, your storage, your networks, or any reason to explicitly trust them. You're all April's Fools still stupidly placing faith in secrets [1] even after endless stream of their lies exposed by exploits, be they cataloged by CVE or even network TV news. [1] Be they commercial, [geo]political, etc. >> Be they overlays on top of the internet, >> enhancements to the internet, >> or new guerrilla physical plant... >> >> That process of people contributing to >> original and ongoing development of new >> strong networks that are not susceptible to such >> Basic Bitch Adversaries as Global Vampires, >> is something more should consider. > Indeed, we'll get there eventually. > I am just a guy that made a thing because I thought it was cool. Yes. Hopefully more will see the need to make cool and different things that can all be competed, evaluated, merged together, and even happily and graciously abandoned and joined up for the next where needed, in order to help get everyone there. This applies outside the Tubes as well. >> Same for likely figuring out how to get >> the deployment Social aspects right so >> you can circle the network wagons against Sybil. > Let the record show that I am not the one making the sybil resistance claims > it's the coin team that is. I doubt them as well but I am open to being > surprised. I orignally had another model in mind for mitigating bad actors > on the network that I still plan on implementing (eventually) > Effectively it's a f2f mesh connectivity layer to help hide traffic shape. There's certainly no lack of pure f2f, or p2p dht, or central, or hybrid tools out there in history. Models, threats, and use cases all being tested and mashed together is good, and fun to do :) Sybil is extremely hard to protect against and root out, since all Sybil needs is Money, and an Excuse to be there. As noted in tor lists since years, the solution to Sybil might not be as complete with only "in network" methods. It will more likely require at least some in real life Web of Trust, Humans asserting over the nodes they run, the software analysing that web, making node selections based on that metadata. "I know her, she works at the store, he's at my meetup group, they're a local company, etc...", and so on, a mesh of persons to persons, running nodes and fiber, all around the planet. You're probably going to need to force Sybil to become a verifiable IRL Human Being... because right now all she needs is money, and her bags are full of it. In a 1 million node network, if half of the nodes are from WoT verified humans, each human runs 10 nodes, and only 50% the users prefer to make exclusive use of the WoT... that's 25k unique logical nodes now showing themselves as being more than just a completely anonymous potentially adversarial [point] source of money renting out boxes around the globe. Can 2.5% of the nodes making up any of todays transport, cryptocurrency, or application network overlays be said to be sufficiently trusted? Do any even need to be? In addition to signing human WoT data in the network layers, you could also start pushing analysis of node metadata into subscribable routing metrics... where are the nodes located, OS, uptime patterns, spec conformance, degrees of WoT such as non IRL nyms, and how strong each asserters verification and assertion policy framework is, etc. All of this and more could raise Sybil's cost and exposure risk qute significantly, perhaps to futility. Everytime the Sybil WoT subject hits the lists it's met with abject silence [or "Johnny can't..."] Is this due to fear of associating with a node (or trying to protect the node by not associating) such that if the node is taken down the operator can walk away or redeploy anon elsewhere? Is that not what Zero Knowledge is for, to allow everyone immunity to say "It's just bits, we have no knowledge or control"? Are advancements toward solving Vampire and Sybil really thought that horrifically "unusable" and "costly"? Or that some won't find them perfectly acceptable? Are the elevated levels of technical, philosophical, educational, and operational participation potentially required all nodes and any solutions thought to be impossible to achieve? Is it easier to just skate by on the odds and continue throwing the victims under the bridge as acceptable losses? > I am not arrogant enough to claim to be able to repell state actors from > sqaure one. Not meaning to have refer to Loki, or any project, but to all nets... We know that, other than routine protocol, code, and human exploits (those three all still being quite sufficient at times), adversaries remaining credible tools against Overlay Networks themselves seem to be Vampire and Sybil. And fake Law, no? It's not only State Actors... any global, regional, or even local tier-n ISP can be an adversary partner Vampire... all you need is to be, or have access to, some pipes... and a willingness to be, or be friendly to, some power, or to wish to gain from your own Vamping. And any NGO or person can be a Sybil... all that takes is money, and in many cases, amusingly little. When head down in code and ops, a bit of talk on the metas is good now and then. Mine should of course be disregarded entirely.

2 1

Loki.network, Crypto Network HW Links, Anti Vampire and Sybil Nets, Actors Everywhere
by grarpamp 03 Apr '19

03 Apr '19

> I am personally convinced that a flat traffic shape will only dare > attackers to cut links between parts of the network, effectively > making an even larger traffic shape to corrilate with. Today if play the cut links game, eventually a toggled link will expose the traffic you seek, because there's no fill between nodes that automatically takes its place. Your global monitor sees a respective signal slump among the nodes making up the subject path, each node distinguishable by time deltas. Such signal the adversary was probably clocking into it themselves for easier recognition anyway... fetch 1MB, fetch 1MB, fetch 1MB, fetch 1MB... oh noes. Tor's hidden services are total sitting ducks because of this. Same for likely all current overlay networks in production regardless of whatever service they provide... from traffic, messaging, storage, cryptocurrency, and so on. There are surely better links from the bib space, yet here are some concepts on generated buckets, retiming, how they can contain full time "empty" fill that yields to wheat demand on the line, traffic contracts, etc therein... https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm If all the nodes are independantly maintaining independant traffic contracts between their physical and/or logical peers, cut links won't do hardly as much impact if anything at all... A \ B + -----> M -----> { U V W X Y Z } C + D / If nodes ABCD on the left are trafficing through M cloud fanning out to the right mesh towards UVWXYZ, then adversary cutout of D is not visible beyond M if M makes up for D's packet slack on its left contract by continuing to emit the same amount as fill to fulfill its right contract. M could variously blackball A for non contractual suspect misbehaviour... weird rates, timing anomalies, uptimes, etc. M could signal BC that they can now renegotiate upwards with M since M now has more rate free on its left. If M is cut out, the left renegotiates with some L or N nodes via new northern or southern arc routes. The "shape" or "bitrate" of the contracts could be negotiated as need be, "flat" might not be necessary, so long as the contract is upheld and policed by all participants to it. Contracts could be one to one, one to many, many to many, physical next IP hop to hop, logical overlay address to address, multiplex, simplex, tunneled, shared, etc. And pertain to bitrates, timing, uptime, any sort of constraints, metadata, etc. This also makes Sybil's life more difficult... it must now own the full path or it will lose sight due to contracts with non Sybil nodes in the path who are also meshed and contracted out to other non Sybils around ot. Sybil must also uphold all its own contracts or get dropped by other nodes. > I am not convinced low latency systems can be immune to traffic shape > corrilation and hence that being said Copper, Fiber, Radio, etc.. so long as it's quality line rate hardware that can keep up with its advertised rate, their time to transfer data is dependant only on distance, not on how full the line is. Such network hardware is agnostic... fill, wheat... it all gets there in the same time. When people say "X latency network overlay", they're really referring to the cost of software processing their overlay design on their crappy stack of PC / Phone CPU hardware. And in their transport protocols running on the same... TCP, UDP, etc... all the way down the stack until it hits the real network hardware, which will either happily accept and ship the packet, or drop it. When people cry about "bandwidth", all they need to do in a fill model is allocate whatever bitrate to it they like and forget it. They're not going to get more bitrate from their ISP than they paid for, and they'll probably contract to the overlay under that so they can do other things with their line. And they're not going to get more wheat bytes across the overlay than a 100% wheat ratio (fill yields to wheat demand) within their contract to the overlay, even if they do disconnect from their byte transfer based ISP / Phone afterwards. Research would need done into routing models needed to transit traffic across the overlay. ie: TCP can readily jam more yet slower circuits through a full pipe, UDP mix gets dropped routed or reserved for. Raw IP becomes interesting. As a network HW project for defense in depth... If hardware makers would add line rate encryption and fill silicon to every physical port on every switch, router, and NIC... mandatory on by default per physical link... that would kill off a lot of vampires. An open IETF RFC spec for that would cost under $1 per port to integrate into existing silicon port fab worldwide, plus electricity to drive the port which would be estimated as part of the RFC process. Modular agility would not cost much more at scale. Assuming line rate hardware, there's no latency impact here either. > I think state actors are out > of scope of the current threat model of llarp. If any network application involves free speech, politics, money aka cryptocurrency, business, journalism, industry, messaging, personal affairs, data storage and transfer, basically anything at all... you can be absolutely certain that many State and Other Actors have a serious continuum of interest in it. Is it the responsibility of each application to develop their own solutions to the threat? No... probably not when many such apps ride on, aggregate muddily over, and depend on networks. All apps can contribute to the development of a diversity sound number of strongly resistant networks that they can then utilize and endorse as they would their own. Be they overlays on top of the internet, enhancements to the internet, or new guerrilla physical plant... That process of people contributing to original and ongoing development of new strong networks that are not susceptible to such Basic Bitch Adversaries as Global Vampires, is something more should consider. Same for likely figuring out how to get the deployment Social aspects right so you can circle the network wagons against Sybil. > This may or may not change. Pity the fool who changes even one satoshi based on the worthless drivel herein :)

3 5

Re: concealed carry: man tries to kidnap 5yo girl, mom pulls a gun, man runs from department store into mall
by Zenaan Harkness 03 Apr '19

03 Apr '19

Apparently into the abyss - who knows what gives. Sometimes there's a probably not really mystical just looks that way from the outside, black hole. Cest la vie. On Wed, Apr 03, 2019 at 10:31:35AM +1100, Zenaan Harkness wrote: > Feel good story of the week courtesy Zerowedgie: > > A Man Tried To Kidnap A 5-Year-Old Girl. Then Mom Pulls A Gun... > https://www.zerohedge.com/news/2019-04-02/man-tried-kidnap-5-year-old-girl-…

1 0

Updating Crypto and Software, Users Role, Flag Days (re: Cryptocurrency, ex: ElGamal)
by grarpamp 02 Apr '19

02 Apr '19

> ElGamal.. Not endorsing or suggesting just noting for whoever that Tor has been updating a lot of its former crypto, here's one example... https://gitweb.torproject.org/torspec.git/tree/proposals/270-newhope-hybrid… Indeed a lot of projects have been and are updating their crypto for various reasons... brokenness, modularity, performance, simplicity, maintenance, quantum... the list goes on. https://neopg.io/ https://boringssl.googlesource.com/boringssl/ ... innumerable examples elided... It's always good to look around and see what's the latest going on in other projects. Many are perfectly good for their use cases, and relatively future proof, thus having no need to update. Others are a public shambles needing wholesale rewrite, fork, abandoned. >> Bad: I2P uses old cryptography, specially 2048 bit ElGamal using non >> standard primes. The use of ElGamal is so pervasive throughout the I2P >> protocol stack that it exists at every level of it. Removing it is a >> massive task that is taking a long LONG time. To the extent the below applies to any project... Projects should not hesitate to utilize flag days where useful. Many projects focus way too much on making seamless transitions. Users are part of projects too, and have responsibilities therein. Let them know this, and they will understand. Cryptocurrencies have been able to make rapid advances, in part because their very first announcements and ongoing processes make very clear that there will be flag days, required software updates, and things users have to do. Setting those expectations, enabling users to take part and pride in playing that role, can allow you to swiftly adapt and update as needed. Much faster than any other project, or adversary, on the market. Instead of being mired in "no changes, no downtime", legacy codebases, lacking features, whatever holds you back, etc.

1 0

Loki-network LLARP I2Pd Torrent Cryptocurrency
by grarpamp 02 Apr '19

02 Apr '19

https://loki.network/ https://github.com/majestrate/torrent.ano http://anodex.oniichanylo2tsi4.onion/ https://i2pd.website/ https://github.com/loki-project/loki-network/blob/master/docs/high-level.txt https://www.reddit.com/r/i2p/

5 9

NSA cybersecurity protection
by grarpamp 02 Apr '19

02 Apr '19

On 4/1/19, Ryan Carboni <33389(a)protonmail.com> wrote: > What is the NSA good for anyway It's TOP SECRET, good or bad, you'll never know, right ;) Known history of such TLA's of the world is not exactly good. Use the wikipedia links for that. Here's some recent news... https://www.reuters.com/investigates/special-report/usa-raven-media/ The American operatives worked for Project Raven, a secret Emirati intelligence program that spied on dissidents, militants and political opponents of the UAE monarchy. It surveilled a British activist and several unnamed U.S. journalists. Key players in the cyber wars of other nations. https://www.usatoday.com/story/news/nation/2019/03/28/ex-nsa-contractor-ple… No indication Martin ever shared the stolen secrets. His defense attorneys say he simply hoarded the information... One of his lawyers previously described Martin as a "compulsive hoarder" who took home work documents > are they just watching American websites get hacked? Yes. Well, that and a whole lot of dick pics... https://www.youtube.com/watch?v=XEVlyP4_11M Among other things... https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-…

1 0

Re: GoldBug Messenger, SpotOn Crypto, etc (Re: Syncing bookmarks)
by grarpamp 01 Apr '19

01 Apr '19

On 4/1/19, Tom A. <thomasasta(a)googlemail.com> wrote: > Hi Grar > like to help you with questions that one can answer, just ask, trying to > share some testings and learnings. > you have a certain view, there is no goal, just telling others who seek > info about sharing good practice experience. > Regards and have a great week Other than your handful of shills, after years there's still apparently no userbase of users on the internet, and certainly zero even remotely trusted voices, that are "sharing their experience" with such supposedly great things as GoldBug Messenger, etc. So instead of writing me... Your gang can "just try" to start by publicly answering the questions people have repeatedly asked you on public lists about your fishy projects. Good luck.

1 0

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America
by jim bell 01 Apr '19

01 Apr '19

Brazil's Top Election Court Catches Google Manipulating Search Results to Point to Negative Entries on Bolsonaro ...Just Like They Do with Conservatives in America. https://tiny.iavian.net/s25s

2 1