March 2020 - cypherpunks - lists.cpunks.org

[RUS] Yolo's money shot^Bquote — “I would still like to at least get some facts supporting our unsuccessful meddling.”
by Zenaan Harkness 22 Mar '20

22 Mar '20

Oh how we love a good troll. And All the better when it's a troll stating a fact. And on the international stage, Sergei "Yolo" Lavrov is a troll on a roll, at the top of his game (+ with a number of other Russkie public figures to be frank) - a great time in history for the comedy connoisseur. ** Watch Russian FM Call British FM a Liar To His Face - He's Absolutely Right (Video) https://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413… ------------------------------------------------------------ by Michael Bateman on Fri, Dec 22, 2017 Oh what a tangled web we weave, when at first we practice to deceive ... Lavrov is on a roll here. Three weeks ago he, correctly, called US Ambassador to the UN Nikki Haley a liar, albeit, not to her face. Watch Boris Johnson bumble through this embarrassing exchange with Lavrov in Moscow yesterday. One thing we can say about Trump, he appears to be speeding up the end game, leaving foreign and military policy essentially to the war hawks - whether this is a good or a bad thing is debatable, but more war is certainly not less war, and more guns and bombs does not mean less shooting and deaths: ** Israel, Saudi Arabia and the US Are About to Invade Syria - Brace For Impact https://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413… ------------------------------------------------------------ by Alexander Orlov on Fri, Dec 22, 2017 The Russian Defense Ministry recently announced that the United States is training a new armed force at the former refugee camp in El Khaseq province, citing the Center for Syrian Reconciliation. ** Trump Opens up US Arms Sales to Kiev, Escalates War in East Ukraine, and Ensures More Russian Aid for Rebels https://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413… ------------------------------------------------------------ by Daniel Larison on Fri, Dec 22, 2017 Trump is pressing ahead with the foolish option of arming Ukraine: The Trump administration has approved the first ever U.S. commercial sale of lethal defensive weapons to Ukraine, in a clear break from the de facto U.S. ban on arms sales that dates back to the Obama administration. ** Iran Is on a Roll - the Deep State Is Definitely Planning a Major Attack https://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413… ------------------------------------------------------------ by (Fash the Nation)Tom Shackleford on Fri, Dec 22, 2017 Primer on Iran Iran is a nation with a long and proud history, dating back to the Persian empire. It is about the size of Western Europe and has a population in excess of 80 million. Iran also has the 3rd largest reserves of conventional (cheaply extracted) oil in the world and the 2nd largest natural gas reserves. Iran is clearly a force to be reckoned with. As such, it considers itself the protector of Shi’a Muslims, who often live under extreme Sunni repression throughout the region. No amount of US pressure has succeeded in halting the “protector” policy.

2 2

Computing: Burn Spare Cycles on these Distributed Compute Projects
by grarpamp 21 Mar '20

21 Mar '20

https://distributedcomputing.info/projects.html

1 0

Arms Update: Coronavirus, 3D Printing, DetDisp, CTRL+P, Jerry Wayne, Bitcoin
by grarpamp 21 Mar '20

21 Mar '20

Colion Noir on Coronavirus https://www.youtube.com/watch?v=Cu_GZMw9gjo https://www.firearmspolicy.org/ https://www.youtube.com/channel/UCQwal7KaCKPDWarooZ3p4Kw/videos https://facebook.com/gunpolicy https://twitter.com/gunpolicy Jerry Wayne https://twitter.com/jerrywaynear14 https://www.youtube.com/watch?v=8FqGPbs0G0w 1st Response to Biden https://www.youtube.com/watch?v=-1dr8QxZ3BM Interview w Ian Haworth https://www.youtube.com/watch?v=MqEriO8i-zQ Interview w Pew Pew Network Deterrence Dispensed on 3D Print and Duncan Lemp with Quinones of Free Man Beyond Wall https://www.youtube.com/watch?v=BFhqM6urpy0 CTRL+Pew https://www.youtube.com/watch?v=nlyWZBOB-Q8 GnB:22 https://www.youtube.com/channel/UCH73VCNIkYR6Eh6idYtpjqQ/videos https://gunsnbitcoin.com/ https://twitter.com/GunsnBitcoin https://www.youtube.com/watch?v=HirN0iGadT4 Ep1 Intro " Internal sales reports show an uptick in sales starting around February 23rd. Sales in the eleven days since February 23rd are up 68% when compared to the eleven days before February 23rd. The company also reported that 45% more people who visit are ordering than normal. We know certain things impact ammo sales, mostly political events or economic instability when people feel their rights may end up infringed, but this is our first experience with a virus leading to such a boost in sales. But it makes sense. A lot of our customers like to be prepared. And for many of them, it's not just facemasks and TheraFlu. It's knowing that no matter what happens, they can keep themselves and their families safe. " " What about muskets? Will you Still be able to Own a musket for home defense, since that's what the founding fathers intended? Just Imagine Four ruffians break into my house. "What the devil?" As I grab my powdered wig and Kentucky rifle. Blow a golf ball sized hole through the first man, he's dead on the spot. Draw my pistol on the second man, miss him entirely because it's smoothbore and nails the neighbors dog. I have to resort to the cannon mounted at the top of the stairs loaded with grape shot, "Tally ho lads" the grape shot shreds two men in the blast, the sound and extra shrapnel set off car alarms. Fix bayonet and charge the last terrified rapscallion.He Bleeds out waiting on the police to arrive since triangular bayonet wounds are impossible to stitch up, Just as the founding fathers intended or Will that be banned too? " https://www.secondamendmentdaily.com/2020/03/sales-of-guns-and-ammo-rise-as… https://townhall.com/tipsheet/katiepavlich/2020/03/13/illinois-mayor-may-ba… https://www.breitbart.com/politics/2020/03/16/new-orleans-mayor-issues-coro…

1 2

Data: Global Religious Futures
by grarpamp 21 Mar '20

21 Mar '20

https://www.globalreligiousfutures.org/ Expect to be repressed.

1 0

NIST Provides Comprehensive Resources for Secure Teleworking
by John Young 20 Mar '20

20 Mar '20

NIST Provides Comprehensive Resources for Secure Teleworking https://csrc.nist.gov/publications/detail/itl-bulletin/2020/03/security-for… https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-46r2.pdf

3 2

Confessions Of A Bikini Waxer: The Dirty Truth
by John Young 20 Mar '20

20 Mar '20

https://medium.com/refinery29/confessions-of-a-bikini-waxer-the-dirty-truth… How many vaginas do you see a day? About 10 a day. Are all vaginas different? Actually, they're mostly the same. I've only seen a handful of very different-looking ones. How many people get their asshole waxed? The majority. The odd one might say, 'Oh no, that doesn't bother me' but most people get it done. What's the one thing you wish people would do before they come for a wax? I just wish everyone prepared. Going to the toilet before they come into the room, and cleaning themselves. I go over the area with a cleanser anyway, but I think it is the client's responsibility. If you're coming from work, or whatever, then just wiping yourself down makes a big difference for me.

4 3

[MINISTRY] [POLICE STATE] - [nettime@kein.org: <nettime> The polish approach to tracking quarantine orders]
by Zenaan Harkness 20 Mar '20

20 Mar '20

Not sure if this is real, but in looks real. I don't speak or read Polish, so cannot verify it. Looks like a test run for other governments.. ----- Forwarded message from nettime's avid reader <nettime(a)kein.org> ----- From: nettime's avid reader <nettime(a)kein.org> To: nettime-l <nettime-l(a)mx.kein.org> Date: Fri, 20 Mar 2020 22:35:07 +0100 Subject: <nettime> The polish approach to tracking quarantine orders List-Id: a moderated mailing list for net criticism <nettime-l.mail.kein.org> [This is softly worded, but from what i understand, this is mandatory. If one is put under quaratine, one has to install this app which will send notification to take a selfie and submit it within not more than 20 minutes. This is more the Chinese approach. No social trust what so ever.] Quarantined Poles can confirm their location with selfies using new government app MAR 20, 2020 | COVID-19, SOCIETY | 0 COMMENTS https://notesfrompoland.com/2020/03/20/new-government-app-allows-quarantine… Quarantined Poles can confirm their location with selfies using new government app A new smartphone application has been launched by the government for people who are under quarantine orders. They will be able to verify their whereabouts by sending selfies, as well as get access to various forms of support during their isolation. Under strict measures introduced in response to the coronavirus pandemic, large numbers of people in Poland are legally obliged to quarantine themselves at home for 14 days. This includes all Polish citizens and residents returning from abroad as well as those who have come into direct contact with people infected with COVID-19. As of yesterday, the total number quarantined stood at 28,440, but this figure is likely to rise sharply. Those caught not complying with the orders face a fine of 5,000 zloty (€1,100). Until now, police have been used to monitor compliance. But now an app launched by the Ministry of Digital Affairs allows those under quarantine to prove they are staying at home. The app is only available for download by people required to undergo quarantine. After registration, they must take a control photo of themself. Thereafter, they will receive one or more text message per day instructing them to send a new selfie within 20 minutes. The system will then use geolocation and facial recognition technology to ensure that the person is at the address provided when entering quarantine. Failure to respond within 20 minutes triggers a reminder, and if this in turn gets no response, the police are notified. “We will be sending requests for photos ‘by surprise’,” said digital affairs minister Marek Zagórski. “The idea is exactly the same as with unannounced visits from police officers.” “The data of people ‘checking in’ from quarantine are safe; they won’t be collected or stored unnecessarily,” added Zagórski, who said that the app would benefit both those under quarantine and the authorities responsible for monitoring them. In addition, the app will provide users with fast access to essential information and allow them to contact local social assistance centres requesting medication or food. The ministry also promises that additional features will be added in the next few days. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org # @nettime_bot tweets mail w/ sender unless #ANON is in Subject: ----- End forwarded message -----

1 0

Facialized: PapersPlease - SEA Port Comm Slurps DHS Dick
by grarpamp 20 Mar '20

20 Mar '20

https://papersplease.org/wp/2020/03/10/seattle-port-commission-reneges-on-i… "***All*** of the comments from the public to the Port Commission on this issue, as members of the Commission acknowledged, were opposed to the Port collaborating with CBP on facial recognition or spending Port money to do so. The Port issued a detailed, self-congratulatory press release within minutes after the vote, which strongly suggests that Port staff knew how the Commissioners would vote before today’s charade by the Commissioners of taking comments from the public and “debating” the issue even began. Today’s decision by the Port of Seattle Commission sets the worst possible national precedent." Seattle Port Commission reneges on its “principles” for facial recognition 2020-03-10 [CBP sign at biometric boarding gate at Newark Liberty International Airport. Note the absence of the OMB Control Number and other notices required by the Paperwork Reduction Act.] Repudiating the principles for assessment of biometric identification of travelers it adopted in December 2019, and effectively mooting the policy development process it had begun since then, the Port of Seattle Commission voted unanimously today to authorize a $5 million, ten-year contract to purchase and install Port-owned common-use cameras and facial recognition stations at all 30 departure gates of a new international terminal. The Port issued a detailed, self-congratulatory press release within minutes after the vote, which strongly suggests that Port staff knew how the Commissioners would vote before today’s charade by the Commissioners of taking comments from the public and “debating” the issue even began. Behind the scenes, US Customs and Border Protection (CBP) appears to have been playing hardball, using the typical law enforcement line of, “We’re going to do this to you anyway. You can either choose to make it easy for us, or we’ll make it hard on you.” The Seattle Times reported after the Port Commission vote that CBP recently began fingerprinting non-U.S. citizens boarding some international flights at Sea-Tac Airport. It seems likely that the implicit or explicit threat by CBP was that if the airport didn’t install and deploy automated facial recognition to track passengers, CBP would use a more humiliating form of biometric tracking, fingerprinting departing non-U.S. citizens the way it already fingerprints non-U.S. citizens when they arrive in the U.S. The choice for the airport and its governing board was whether to collaborate with CBP. Port Commissioners seemed to want to reign in CBP. But at the end of the day, they proved unwilling to assert their authority as an elected public oversight board against the malign convergence of interest between government agencies, airlines, and Port staff who identify with the police and the airline industry more than with the public. The Port Commissioners chose to have the airport actively collaborate with and front for CBP, at the airport’s expense, rather than dissociating itself from CBPs flagrantly illegal activities, making CBP do its own dirty work at its own expense, or trying to mitigate the damage through signage informing travelers of their rights. The Port press release claims that “the Commission’s goal is to replace CBP”, but that’s clearly false and appears intended to mislead the public. In fact, the sole purpose of the cameras and software to be purchased by the Port is to augment, not replace, the ability of CBP to use, retain, and share photos as its sees fit. Every photo of a traveler taken by the Port cameras will immediately be sent to CBP. There’s no plan to replace CBP, deny it access to any photos, or expose its secret algorithms and secret biometric databases. All of the comments from the public to the Port Commission on this issue, as members of the Commission acknowledged, were opposed to the Port collaborating with CBP on facial recognition or spending Port money to do so. Members of the public, including experts in cybersecurity and threat modeling, pointed out that many key questions about the Port’s proposal and CBP’s and airline’s practices, plans, and policies remain unanswered. Most urged the Commission to reject the proposal outright and withdraw its request for bids for facial recognition equipment. All commenters agreed that approval of the procurement contract would be premature until more information is made available to the public and the current policy development process is completed. In our latest written comments to the Port Commission today, which we summarized in person at today’s meeting (see also our previous submissions to the Port Commission on December 10, 2019, and February 25, 2020), we pointed out that: The proposed procurement and deployment would violate Federal law, the norms of Fair Information Practices (FIPPs), and the professed “principles”, including FIPPs, of both the Port and US Customs and Border Protection (CBP). It should be rejected, and the RFP for this project should be withdrawn or, at a minimum, postponed…. It isn’t just that CBP is violating the Privacy Act, or that collecting facial images and sending them to CBP would make the Port complicit in this violation of Federal law. The violation of the Privacy Act by CBP lies specifically in CBP’s outsourcing the collection of this personal data to the Port, airlines, or any other non-Federal entities. This provision was and is included in the Privacy Act for good reason. The Port should heed it, and make CBP comply with Federal law by collecting any personal data it uses for making decisions about individuals, including facial images of travelers, directly from those individuals. CBP could collect this data itself at Sea-Tac, as it does at some other airports. It doesn’t want to, but it has clearly demonstrated that it could do so. If there is one lane at a departure gate, or on arrival, where a uniformed CBP agent is photographing travelers, and one lane without a Federal law enforcement officer with a camera, travelers will have a much clearer and more informed choice – and one that, unlike the proposal before the Port Commission, might comply with the Privacy Act. Port Commissioners claimed, quite implausibly, to think that having the Port install and operate the cameras would give the Port some control of how CBP uses the photos after the Port sends them on, or at least more control over signage. But CBPs “Biometric Air Exit Business Requirements” for its airline and airport “partners”, which were finally disclosed only two days ago in response to our request, and were never provided to or reviewed by the Port’s “Biometrics External Advisory Group” (BEAG), tell a different story about who’s in control. As we explained in our comments: Some Port staff, in their proposals to the BEAG and the Port Commission, have suggested that by owning and operating facial recognition systems the Port would have more control over signage and other notices provided to the public to enable more informed consent and mitigate the harm to the public of CBP’s (illegal) activities. But in fact, the proposed procurement would have exactly the opposite effect. By agreeing to comply with CBP’s “Requirements” – which are explicitly incorporated by reference in the RFP and the proposal for action by the Port Commission – the Port would be tieing its own hands and committing itself to display CBP’s signs – regardless of their truth or falsehood or their compliance with the law – and not to display any signage, make any announcements, or provide any information not approved by CBP. Item 8 of CBP’s “Requirements” would prohibit the Port from posting any signs or distributing any communications pertaining to CBP’s use of biometrics without CBP’s prior approval. Item 13 of CBP’s “Requirements” would obligate the Port to post whatever signage CBP demands, regardless of whether the Port considers it inaccurate, misleading, or incomplete. In effect, these provisions would amount to a (self-imposed) gag order not to criticize CBP, and a (self-imposed) agreement to serve as a mouthpiece for CBP propaganda, regardless of its truth or falsehood. Rather than enabling the Port to mitigate the harms of CBP’s (illegal) practices through more or better signs or announcements, the proposed action by the Port Commission would prevent the Port from doing so. If CBP fails – as it has failed to date at Sea-Tac and all other airports with biometric departure gates – to post the notices required by the Paperwork Reduction Act, informing individuals, regardless of citizenship or immigration status, of their right not to respond to any Federal collection of information that does not display a valid OMB Control Number and PRA notice, the Port itself should post such notices at all gates. But the Port won’t be able to do so without CBP approval (which wouldn’t be likely to be granted) if the Port Commission approves the proposal on your agenda for action today. Port Commissioners approved a motion declaring that CBP’s uses of facial recognition at airports are “lawful”, while simultaneously and hypocritically dismissing our objections to CBP’s flagrant violations of Federal law by saying that, “We’re not judges. If a court says it’s illegal, we won’t do it.” This ignores the fact that, as we also noted in our comments, CBP and DHS have promulgated regulations exempting the databases in which they store facial images from the rights otherwise available to individuals under the Privacy Act to access, accounting of disclosures, and civil remedies for violations. This makes it all but impossible to have CBP’s practices reviewed by the courts. Today’s decision by the Port of Seattle Commission sets the worst possible national precedent. But it doesn’t render the Port’s ongoing process of developing policies for use of biometrics at Sea-Tac entirely irrelevant. We will continue to monitor the process and engage with the Port Commission as it considers use of facial recognition (in collaboration with, and sending passenger photos to, CBP and perhaps in the future the TSA) by airlines and other commercial entities for their own purposes. As we noted in response to the first draft of a Port of Seattle policy for “non-Federally mandates” uses of biometrics: Missing from that draft is any explanation of the purpose or justification for airlines to identify passengers, independent of any Federal mandate. Airlines could, and did, operate for decades without requesting ID from passengers. Airlines began asking (but not requiring) passengers to identify themselves only when they were ordered to do so by the FAA (the predecessor of the TSA). The only lawful reason for airlines to ask passengers for ID is to satisfy a government mandate. As common carriers, airlines are required to transport all passengers, regardless of who they are, and are required to sell tickets at prices determined by a public tariff. An airline cannot lawfully “reserve the right to refuse service”. It cannot lawfully personalize prices or charge different prices based on passengers’ identities. So why do airlines think they “need” to identify passengers at all, by any means? One cannot assess the justification (or lack thereof) for biometric identification of travelers for non-Federally mandated purposes without first assessing the justification (or lack thereof) for identification of travelers generally for such purposes. This assessment is entirely absent from the draft recommendations for Port policy, but is essential.

2 1

Documents: The Black Vault - FOIA, SECRET, Etc...
by grarpamp 20 Mar '20

20 Mar '20

https://theblackvault.com/ The Black Vault Exposing government secrets... one page at a time. Where do you want to go? Case Files, UFOs & The Unknown Declassified Documents 2,165,772 Pages Online Message Forums are Open!

1 0

root "login" xterm to increase security?
by Zenaan Harkness 20 Mar '20

20 Mar '20

So someone cracking into one's local user account via browser sploit, one of the first acts would likely be to plant a password capture script, e.g. wrapping sudo or something otherwise requiring password entry. Once a password is obtained, via brute force or trojan, sudo gives the entire system away. A convenience is some do "useradd me disk" - but again, any crack of local account (even without password), now gives away all disks. Convenience vs security. So what to do? 1) delgroup me disk "Important" data such as keyfiles ought be stored with no "primary user account access", so group "disk" ought not be part of "primary user"'s groups. Are there any other groups that "really ought" be removed from the local primary user account? 2) Disable sudo and disable su su (as well as sudo) again has the problem of password capture if su or sudo is run from the primary user account after a sploit + trojan planted. So, obviously, we need "clean" root logins, i.e.: - separate root account for admin/disk tasks - clean login, i.e. not via primary user account but using a clean "login" process outside any user account And so logically, the immediate test is as follows (does not work for me, gives me a .profile/.bashrc shell, not a login prompt): xterm -ls Note man xterm: -ls This option indicates that the shell that is started in the xterm window will be a login shell (i.e., the first character of argv[0] will be a dash, indicating to the shell that it should read the user's .login or .profile). The -ls flag and the loginShell resource are ignored if -e is also given, because xterm does not know how to make the shell start the given command after whatever it does when it is a login shell - the user's shell of choice need not be a Bourne shell after all. Also, xterm -e is supposed to provide a consistent functionality for other applications that need to start text-mode programs in a window, and if loginShell were not ignored, the result of ~/.profile might interfere with that. If you do want the effect of -ls and -e simultaneously, you may get away with something like xterm -e /bin/bash -l -c "my command here" Finally, -ls is not completely ignored, because xterm -ls -e does write a /var/log/wtmp entry (if configured to do so), whereas xterm -e does not. QUESTIONS: a) anyone know how to make xterm -ls give a 'clean' login prompt? b) is any presumption of a "clean" login prompt inside xterm, when launched from a primary account xterm session, a folly? c) is there any other option for root in X, which could be considered "resonably secure" in the face of a cracked local X using account? 3) Qubes. Isolate each activity into its own VM. Notwithstanding hardware/CPU level firetruckery (another problem which as grarpamp reminds us requires OpenFabs, OpenHW, OpenCPU etc), isolating each activity, especially public facing activity such as web browsing, appears to be a very reasonable proposition - this way a browser crack means root access in the browser's VM, and not automatically into the rest of the system (VM sploits notwithstanding).

4 6