May 2020 - cypherpunks - lists.cpunks.org

T shirt facial recog disguise?
by jim bell 13 May '20

13 May '20

New t-shirt design promises to disrupt facial recognition cameras https://mol.im/a/8313221 via http://dailym.ai/android

1 0

Surveillance: Thought Control Wants To Know Your Thoughts
by grarpamp 13 May '20

13 May '20

https://www.thedailybeast.com/mitch-mcconnell-moves-to-expand-bill-barrs-su… https://s3.amazonaws.com/demandprogress/letters/Coalition_Support_for_Daine… see: EARN-IT Act

1 0

Nextgen Traffic Analysis Resistant Overlay Networks (re: tor replacement box)
by grarpamp 12 May '20

12 May '20

>> https://lists.cpunks.org/pipermail/cypherpunks/2020-May/080509.html >> mid: CAD2Ti282noLJEugQ8dQ6BAnbfxdz8DDy1xUpNAXSXMxHNN Being potentially applicable to a more abstract generic overlay transport network handling modular applications, one perhaps being 'replacing tor'... bell writes: > 'chaff' might have been a problem if > the people who host the nodes had some limited-data Internet service, but I > am aware that Centurylink now offers 1 gigabit service for $65 monthly, and > I think that service has no monthly data limit. (their slower services have > a 1 terabyte montly limit). That should be plenty to allow for generous > chaff. Things maybe different from the notion that paying high speeds, enables sufficient chaff, enables sufficient security. Data limits vs bitrate vs network fill chaff vs security. A network normally filled fulltime during user-idle time with right-of-way-Yielding chaff, then yielding way dynamically to user-not-idle traffic demand of right-of-way-Having wheat, an equation is... (rowY chaff + rowH wheat = at all times ensuring the provisioned line rate is full) ...that is self enabling, regardless of bitrate, caps, or money. If user has a 'data limit' specified as a quantity (typically Bytes in a period), they can generally save some quantity for later consumption by... - turn on client, use for whatever, turn off client ...but client must still conform to equation above when running, else no security improvement over todays existing overlay networks. 3TiB/mo = 100GiB/dy = 10Mbps Any data quantity limit per time period breaks down as above into an available constant bitrate. If that bitrate is not enough for user to do whatever within, say voiceconferencing at stupidly offensive codec bitrates, then they must play the on/xfer/off game above to convert more saved quantity into now bitrate, this is simple physics. They only have bitrate up to the max they got from ISP, the maximum even then is up to the hard physical link speed PHY. Both of which are usually higher than any data quantity limits the user bought and got provisioned because the ISP wants to rape user's bill for Bytes (the ISP aggregates and only deals in bitrate pipes upstream anyway, Byte caps are just counters triggering management scripts over pipes). Point is, constant bitrate <=translate=> data quantity. And the constant background of chaff would yield its way packet by packet on the fly upon demand of the quantity of user's wheat flow, whether the demand be for 0% up through 100% of the line, all [re]clocked back out the NIC. Whatever the %, and for the varying duration and amount of its demand, that wheat is in fact become part or all of the fill traffic needed to prevent traffic analysis across the network. Security of the net requires all network nodes to always enforce the above equation when running. So there is probably less notion of this 'allow for generous chaff', only the notion of if the user has purchased enough capacity to do what they want. If they didn't buy enough, nothing will let them dodge their provisioned physics. This physics is no different than with Tor, I2P, bittorrent, IPFS, BTC, this model or anything other, or even plain old raw websurfing straight out user's NIC to their ISP to YouTube. 1Gbps = 300TiB/mo = $65/mo 1TB/mo = 3Mbps = $?/mo Only one of those two ISP plans will allow the user to do 10Mbps of demand. The network is still secure during their use of it regardless of which plan they choose or how they choose to use it. If talking about 'hosting' nodes, meaning configuring them up as transit nodes, possibly in addition to user's own use of them as endpoints, the same equation still applies. People still too often think of chaff by the old fashioned models, they still assume chaff can only be in addtion to or somehow taking up space for or blocking out wheat... the equation above offers a new dynamic yield-right-of-way model to think about. All nodes, whether end user endpoints or any other type, must generate equation conforming fill of their entire virtual connection rates into the overlay [1], else... - Pairs of endpoint traffic patterns can still be matched up. - Overlay cloud will have quieter/unregulated paths that will eventually get randomly chosen by endpoints to path through yielding a traceback match. ... tor tries to game these with noise and aggregation, but that may not be sufficient. Nodes auto negotiating bandwith rates among peers, enforcing those contracts and [re]clocking expectations, else dropping them out as suspect, still applies as usual. Migrating end users from any of today's overlays would set one new thing... the end users subject to data caps would configure their node to sit idle until it detects their call for the network, or just turn it off. Both those and unrestricted users gain access to some more analysis resistance in usual transparent-tor-like sort of way. The model might not depend or care about how traffic moves around inside the network, or what the apps it carries are. It maybe possible to apply to any existing or new overlay network as an external function managing its traffic over the NIC to/from its peer nodes on clearnet, like in old ATM cell bucket brigade fashion. foreach bucket in negotiated_clocked_rate if demand then send demand else send chaff This scheme probably rubbish anyway. [1] The real pipe bought from ISP might have some virtual rates carved from it by user for other clearnet applications. In a router device, this would be the typical red/black ports and rate limit packet filters, so that traffic doesn't impede each other, or provides a dynamic use equation for the real pipe. bought rate = rate allocated to clearnet apps + rate allocated to nextgen overlay app

1 0

ThunderSpy: Intel Fucks Up Closed Source HW Again
by grarpamp 12 May '20

12 May '20

https://thunderspy.io/assets/reports/breaking-thunderbolt-security-bjorn-ru… https://github.com/BjornRuytenberg/spycheck-linux Thunderspy targets devices with a Thunderbolt port... an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep. Thunderbolt devices possess DMA-enabled I/O. In an evil maid DMA attack Thunderbolt has been shown to be a viable entry point in stealing data from encrypted drives and reading and writing all of system memory. In response, Intel introduced Security Levels. We present Thunderspy, a series of attacks that break all primary security claims for Thunderbolt 1, 2, and 3. Inadequate firmware verification schemes Weak device authentication scheme Use of unauthenticated device metadata Downgrade attack using backwards compatibility Use of unauthenticated controller configurations SPI flash interface deficiencies No Thunderbolt security on Boot Camp These vulnerabilities lead to nine practical exploitation scenarios. Cloning user-authorized device identities to arbitrary attacker devices Permanently disabling Thunderbolt security and future firmware updates All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable. The Thunderspy vulnerabilities cannot be fixed in software Avoid leaving your system unattended while powered on, even when screenlocked. Disable the Thunderbolt controller entirely in UEFI (BIOS). Stay tuned for Thunderspy 2: Judgment Day. Intel has stated they had been already aware of Thunderspy variants... Intel has not shared why they have chosen not to inform the general public. The author of Thunderspy would like to thank prof. dr. Tanja Lange and Jacob Appelbaum for supervising his MSc thesis, of which this work is part, at Eindhoven University of Technology, the Netherlands. Oops!... ClosedHW did it again! https://www.youtube.com/watch?v=oIkRKc8wX24

1 0

[RUS] Who split Germany after WW2?
by Zenaan Harkness 11 May '20

11 May '20

Most us propagandized flunkies in the inglorious West don't actually know our history. For those who appreciate a quick catch up here and there, read it and empathize: http://russiafeed.com/divided-germany-cold-war-washington-moscow/ Who divided Germany during the Cold War – Washington or Moscow? The Soviet proposal for a neutral, united Germany was refused by the West, in order to create their own puppet state by Nikolay Starikov December 8, 2017, 12:17 pm

2 1

[Soul Cookie] - 'The Russians Are Coming': How East Germans Met Soviet Soldiers in 1945
by Zig the N.g 11 May '20

11 May '20

A Soul Cookie for our weary locked down covidbrains - some personal recollections of a child as The Russians were coming, and did indeed come! 'The Russians Are Coming': How East Germans Met Soviet Soldiers in 1945 https://sputniknews.com/interviews/202005101079256651-the-russians-are-comi… .. The soldiers almost panicked when talking about the horrors to be expected from the Russians, always advising my mother to "flee" to the west as soon as possible. But we had no relatives or acquaintances in Germany who could shelter us. ...

1 1

Headline: "Did we just witness one of the nuttiest foreign policy blunders in American history?" Jim Bell doesn't thing so.
by jim bell 11 May '20

11 May '20

https://usa-onlinenews.com/2020/05/07/did-we-just-witness-one-of-the-nuttie… "I cannot be the only American who somehow missed the news that on March 26 Secretary of State Mike Pompeo announced the United States would offer bounties of a combined $55 million for the capture of President Nicolás Maduro of Venezuela and four of his top associates. By the end of March, most of the country was living under some sort of mandatory lockdown. People were fighting for toilet paper and stocking up on bags of rice and making plans for aspirational quarantine reading. Millions of us were preparing for Mad Max. "It now appears that we were thinking of the wrong '80s action flick. Last weekend it was reported that a group of more than 100 American mercenaries, including two former Green Berets and one ex-agent from the Drug Enforcement Administration, had failed in some kind of apparent coup attempt and that some of them were being detained by the Maduro government. What was being called "Operation Gideon" perhaps unsurprisingly failed to bring about regime change, much less result in the apprehension of the country's socialist dictator. Reports suggest that 50 of the mercenaries stormed Venezuela by sea, joining up with around the same number of fellow soldiers of fortune already waiting behind enemy lines. The Venezuelan army (and Maduro's own paramilitary loyalist forces) outmatched them by around 350,000. A small ragtag band of American warriors attempts to force the commies out of South America against all odds? This is basically the plot of Predator if the Predator hadn't shown up. "Pompeo maintains that the United States government was not involved in this offensive. For what it's worth, he is probably telling the truth. Instead it appears that the plot was launched long ago by a bunch of former Venezuelan military officials who have been training deserters from the Maduro regime in secret Colombian camps for a year. One of the principals, a retired general named Cliver Alcalá, was arrested in the United States back in March for drug smuggling and is imprisoned in New York." [end of partial quote] Jim Bell's comment follows: I consider the headline of this article foolish. It suggests that a single attempt to remove Maduro and his corrupt cronies, having failed, somehow means that the entire concept of offering a reward for their removal is somehow ill advised. To the contrary, it might have succeeded, at which point the plan would have been labelled "brilliant". The world doesn't get just one chance to do so. If there was one thing about this idea that was foolish, it was offer to give that money only if Maduro et al were "removed", not killed. It would probably be much easier to kill Maduro than to engineer his physical removal from Venezuela. I also wonder if the United States Government set up any sort of system to allow people to anonymously collect this $55 million. So, how do these people imagine that they will be able to successfully get away with this money? IF the US government secretly says to them, "We're only giving you one tenth of what you were promised. Be glad we gave you that much. If you complain we'll broadcast your name, picture, and location to the entire world!" A large promised reward is only useful if the potential collector is confident he will actually receive all of it, and won't be killed by enemies before he is good and old. Jim Bell

2 1

Cryptocurrency: DEX - Distributed Exchanges
by grarpamp 11 May '20

11 May '20

> https://en.bitcoinwiki.org/wiki/DEXes DEX is distributed exchange, think D-Ex. Decentralized exchange is not, think De-X. Visualize, but consider also a DEX execution net more a distributed-state-of-swap-tx-db or messaging-like to which trades all plug and tx into, not necessarily a p2p routing network per se... https://static1.seekingalpha.com/uploads/2018/2/1/389729-15174980652034152.… Most so called "DEX" today are spamvertised corporate startup lies, worthless garbage infested with some things that make them not a true DEX... a) Centralized or "De-X" not truly distributed in some p2p or chain net sense. b) Works only with one particular token family or blockchain network. c) Have arbitration, escrow, insurance, brokerage, custody, entry fee'd, governed, staked, taxed, trades fiat, keeps a record, has support desk, etc. Binance style central exchanges running on onions are not DEX. OpenBazaar markets are not DEX. XMR, ZEC, JoinMarket, CashShuffle, CashFusion are not DEX. McAfee DEX (OEM'd @switchdex switch.ag) is not really a true DEX. ERC20, SLP, etc families only... must be made cross-chain DEX compatible. BlockDX is more like a true distributed atomic cross-chain DEX. Others coming soon. A true DEX will be a cross-chain fully distributed non-custodial uncensorable exchange protocol, its own atomic execution network, blockchain-ish, messaging or transaction advertisement meta layer API running over some privacy overlay network in free space. Generally requires each participant coin to have set of atomic exchange and cryptographic API functions into the DEX such that any market pair among the coins can be composed and executed free of counterparty risk. ccDEX - emphasizing cross-chain to eliminate all the ETH and other token only DEXs from consideration. Atomic - emphasizing committal of nominal values in key form to the exchange protocol net for proofed agreement, execute or return. Both sides either have the privkeys and safely swap over the protocol in time, or they don't. Some DEX use intermediate mechanisms. Some early DEX protocol research and operational nets are out there, for which further searches will return even newer more advanced work... bitshares etherdelta bisq 0x nvo-safenetwork blockdx.co/blocknet.co avalanche tao method language Standardized DEX protocol API's will emerge and be adopted. If you can sue it, shoot it, shut it down, get censored, premined, gov / founder taxed, kyc'd, deanon'd, lose money to the protocol or humans, not be opensource, not be privacy, waste disk space, vote governance stake force over free networks etc... then 10+ years past Genesis, considering today's available and forthcoming crypto tech, it's not a DEX, and it's not a cryptocurrency... it's just central fiat.

2 3

Cryptocurrency: On the need for banks
by grarpamp 11 May '20

11 May '20

> A few (2 billion?) dollars were actually created by JFK's government, but not since. That would be... https://en.wikipedia.org/wiki/United_States_Note There are no relevant countries that remain free from Govt Central Banks... https://en.wikipedia.org/wiki/Central_bank https://en.wikipedia.org/wiki/List_of_central_banks There are no countries fiat at all that are backed by Gold or any other resource, it's all 100% fiction, the convertibility ratio, at their issuance window, back into anything, is precisely zero... "From this point, the international monetary system was made of pure fiat money." https://en.wikipedia.org/wiki/Gold_standard Any "reserves" are no longer used to back their fiats literally, it's now more a trading, settlement, forex, and wargames thing... https://en.wikipedia.org/wiki/Gold_reserve Some like DPRK and others in the news are even getting into holding and trading cryptocurrency now. > ratio of capital to loans is the "reserve ratio", which was around > 15% but years ago got reduced to 3% and from memory even lower There are a number of points in systems various reserve ratios are applied. US Fed indeed just cut, and set some other to 0%, when COVID hit, see their site. > actual dollars in existence (M1 vs M0 etc) Physical money, coin, vault cash, etc often limited, including by War On Cash now. M2/capita is more related to gold price, M2 is exploding through various means. > interest is not created at the time the loan ... unbalanced Instead of simply walking away upon recognizing unbalance, conditioning and systematic control blackmarking structures can trip people and entire nations into doing theft and war to steal resources to pay it back and balance the books. Curiously, some religions forbid interest, but in practice even some strict among them still can be seen hypocritically using interest and derivatives in some form or another, laughably certifying them as legit. Even paper gold and gold leasing have become a thing for decades now. Also left out was the underlying structure known as Govt [Treasury] Bonds, the utter bullshit premise that a Government can issue them to backstop even their own central banks, that a Govt can enslave tax you and attach whatever little you still freely own, without your explicit consent, into backing the debts of the Govt, Central, and Commercial banks, and their lendees. The idea being that, when all defaults roll up, that you get stuck with pay off their bond, else international and other claimants invade. Too big to fail? QE2inf? Inflate out? Nope, pay us. That's like ridiculous notion you are and bound yourself to some fantasy Constitutions or "social contracts" without explicitly signing, by unluck of being born into such shitholes, letting such unfiduciary unrepresentatives continue to elect themselves and rule over you with their democracies. Feel like shit and a dumbass yet? https://en.wikipedia.org/wiki/Gold_as_an_investment https://en.wikipedia.org/wiki/Gold_holdings Upside... cryptocurrencies and even gold, guns and goats are coming into more favor worldwide now. People don't want to be left holding the short end of fiat. Collapse or not, these harder forms are still infinitely useful to your cause. When literally every place on the planet is now overrun by Government and Central Banks, every flavor in history, now joining into one, holding their lightswitch and risks over you... one answer is not to keep trying to fix them, but to route around and get rid of them, to go entirely different ways that don't involve them.

1 0

Tanzanian president Magufuli puts WHO niggers in their place
by Zig the N.g 11 May '20

11 May '20

Tanzanian president John Magufuli put WHO niggers in their place when he became suspicious of WHO and sent them samples of papaya, a goat and a quail, for COVID-19 testing. All samples came back from the WHO as "positive for COVID-19". Magufuli then kicked the WHO out of Tanzania ~2 days ago and fired the head of Tanzania's testing lab. "We Sent Them Samples Of A Goat, A Papaya & A Pheasant": Tanzanian President Catches WHO In Epic Lie https://www.zerohedge.com/geopolitical/we-sent-them-samples-goat-papaya-phe… .. But we'd love to hear Bill Gates regale us with "data-based arguments" about why the WHO is indispensable to the international effort to combat the coronavirus.

1 0