July 2020 - cypherpunks - lists.cpunks.org

[Cypherpunks] “Internet is a very large-scale spying machine”
by Alexander Protector 07 Jul '20

07 Jul '20

Forwarding a great message from the cryptome list. ---------- Forwarded message --------- Subject: [cryptome] “Internet is a very large-scale spying machine” To: cryptome(a)freelists.org <cryptome(a)freelists.org> see url: https://www.rt.com/news/cryptome-classified-secret-wikileaks/ Quote<<< Cryptome.org was publishing classified and secret documents long before WikiLeaks made headlines. Cryptome co-founder John Young told RT such sites are allowed to stay online so that spy services might keep an eye on their visitors. There is no secrecy on the Internet, John Young warned.“In terms of their being able to see everything that we are doing, we know that we cannot keep any secrets about our site and we tell our readers, ‘You should not expect us to protect you, because we are being watched and every other site is being watched, just like WikiLeaks is being watched,’” he said. “There’s no secrecy on the Internet – that’s the lesson we’ve learned and we are now trying to spread that.”“They [the security services] use our site to see what’s going on and that’s something that we’ve learned about sites like ours. They are left in place in order to watch who comes there and see what kind of information we’ve put up,” John Young added. “The reason we haven’t been shut down is that we are useful to them to see what kind of attention is paid to this material. We think they actually feed us material to put up as they are feeding information to WikiLeaks and many other sites that operate the same way.”John Young said Cryptome grew out of his participation in the group called Cypherpunks – which was also the group in which Julian Assange learned his skills.“This group was composed of very highly-educated engineers, scientists and technicians who were mostly working for corporations and government on the technology of communication security,” he said.Cryptome’s co-founder said secrecy is a biggest enemy of democracy.“Threats to democracy come from the secret keepers, and they need to be exposed. It has become a huge industry and it’s extremely expensive,” he said. “And you can’t criticize it, you can’t get access to it, because those who go inside that world are sworn to life-time secrecy about it and they can never talk about it.”“This is a system which is anti-democratic and it’s a big business now. Thousands of firms have been drawn into it since 9/11, because it is very lucrative. We need to have less secrecy in Congress, less secrecy in the presidency, less secrecy in all forms of government,” he says.John Young said governments leak more information for their own purposes than all the secret leaking websites put together.“They [governments] run operations to leak secrets to test their own system,” he said. “There are schools to train people doing just that on the Internet. They teach their own people how to run these sting operations by leaking information to test their system. They are sometimes called A-teams and B-teams.” >>>End of Quote

1 0

in app (Java) crypt "file store"/ media cache ?
by Zenaan Harkness 07 Jul '20

07 Jul '20

In app media cache ought be in a crypt by default. Has anyone done this before and can give hints? Platforms: initially android, but should be compilable for others including Linux Object types: avatars, tweets, associated media including images and even vids - whatever is in a standard social media 'stream'. Obviously cache needs to be parameterizable as to size, eviction policy, but it's not going to be unencrypted. Come to think of it, FreeNet's code might be good, at the very least as a tutorial - but experience is always valuable, so if you have some experience you can share, please do. To simplify eviction, objects should be separate files, compressed prior to saving, with one or more indices (also encrypted) for the application to do it's thing efficiently, including store, lookup, read and re-enrypt when an object is to be on-forwarded. Content addressed in some way of course - git has lead the way on this principle - we just must make sure that if the user does not give up his password, anything lying around must meet some minimum "hiddenness" standard. Possible libs: # Tuweni https://github.com/apache/incubator-tuweni https://tuweni.apache.org # Ancient Nacl-Java https://github.com/freeeve/nacl-java # looks like a one man band, not updated for 5yrs # Libsodium https://github.com/jedisct1/libsodium https://doc.libsodium.org/ https://doc.libsodium.org/bindings_for_other_languages # "complete security audit" # Seems to be used by Tuweni Docs: # Java Cryptography Architecture (JCA) Reference Guide https://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/Cryp… Tutorials: https://www.tutorialspoint.com/java_cryptography/index.htm https://www.tutorialspoint.com/java_cryptography/java_cryptography_encrypti… # simple block encryption # Java - Asymmetric Cryptography example - Mkyong.com https://mkyong.com/java/java-asymmetric-cryptography-example/ https://github.com/amiralis/Java-crypto-tutorial Encrypting and Decrypting Files in Java | Baeldung https://www.baeldung.com/java-cipher-input-output-stream How to easily encrypt and decrypt text in Java https://www.adeveloperdiary.com/java/how-to-easily-encrypt-and-decrypt-text… Encrypt and Decrypt file/stream in Java https://self-learning-java-tutorial.blogspot.com/2017/09/encrypt-and-decryp…

3 10

WIRED: Hackers Are Exploiting a 5-Alarm Bug in Networking Equipment
by jim bell 07 Jul '20

07 Jul '20

WIRED: Hackers Are Exploiting a 5-Alarm Bug in Networking Equipment. https://www.wired.com/story/f5-big-ip-networking-vulnerability

1 0

recommendation for offline Markdown renderer (for GitHub .md)?
by Zenaan Harkness 06 Jul '20

06 Jul '20

Anyone got a strong recommendation for an offline Markdown renderer which can at least do a passable job rendering GitHub's .md style? grip uses GitHub API, contacts the server on every render, seems to not even cache CSS files... Also!: GitHub supports inlining section files (very useful for reducing file size/ dividing one large file) with this: <file name="section_2.md"> So having that work with an offline renderer would be gold™...

4 4

Fw: debmirror: apt update performed "unsandboxed"? ~=> file path not readable
by Zenaan Harkness 06 Jul '20

06 Jul '20

In case this is of interest. ----- Forwarded message from Zenaan Harkness <zenaan(a)freedbms.net> ----- From: Zenaan Harkness <zenaan(a)freedbms.net> To: debian-user(a)lists.debian.org Date: Mon, 6 Jul 2020 20:49:52 +1000 Subject: debmirror: apt update performed "unsandboxed"? ~=> file path not readable This was a question, but after some digging, answered itself (see near bottom), via a short recursive path analysis script showing that one path component of the path hierarchy failed to have world-readable perms (a dir in the middle), so in case it's useful for some: Local debmirror mirror, InRelease is out of date so setting Acquire::Check-Valid-Until=false but getting "unsandboxed" notice/warning: # apt update -o Acquire::Check-Valid-Until=false ------->> 20200706@20:16:10 <<------- Get:1 file:/public/debian/sid sid InRelease [146 kB] ... Ign:2 file:/public/debian/sid sid/main amd64 Packages Err:3 file:/public/debian/sid sid/main Translation-en File not found - /public/debian/sid/dists/sid/main/i18n/Translation-en (2: No such file or directory) Get:4 file:/public/debian/sid sid/contrib amd64 Packages [70.1 kB] Reading package lists... Done N: Download is performed unsandboxed as root as file '/public/debian/sid/dists/sid/InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied) E: Failed to fetch file:/public/debian/sid/dists/sid/main/i18n/Translation-en File not found - /public/debian/sid/dists/sid/main/i18n/Translation-en (2: No such file or directory) E: Some index files failed to download. They have been ignored, or old ones used instead. Now when checking that file which is purpotedly causing the "unsandboxed" 'download', we get this: # ll /public/debian/sid/dists/sid/InRelease ------->> 20200706@20:19:22 <<------- 93K -rw-r--r-- 1 zenan zenan 143K 20200627 16:32.03 /public/debian/sid/dists/sid/InRelease Clearly that file is readable by all users.. hmm. So let's analyze the full path: $ zfile /public/debian/sid/dists/sid/InRelease ------->> 20200706@20:25:42 <<------- ---- Analyzing "/public/debian/sid/dists/sid/InRelease" type: /home/zenan/bin/zfile: line 9: type: /public/debian/sid/dists/sid/InRelease: not found f: /public/debian/sid/dists/sid/InRelease Drwxr-xr-x root root / drwxr-xr-x root root public lrwxrwxrwx root root debian -> /Library/Lpools/zen/p1-setups_misc/repos/debian Drwxr-xr-x root root / drwxr-xr-x root zenan Library drwxr-xr-x root root Lpools drwxr-x--- zenan zenan zen Drwxr-xr-x zenan zenan p1-setups_misc Drwxr-xr-x zenan zenan repos drwxrwxr-x zenan zenan debian lrwxrwxrwx root root sid -> d00 lrwxrwxrwx zenan zenan d00 -> d00-sid+tst+src-64 drwxr-xr-x zenan zenan d00-sid+tst+src-64 drwxrwxr-x zenan zenan dists drwxrwxr-x zenan zenan sid -rw-r--r-- zenan zenan InRelease -rw-r--r-- 1 zenan zenan 146310 Jun 27 16:32 /Library/Lpools/zen/p1-setups_misc/repos/debian/d00-sid+tst+src-64/dists/sid/InRelease /Library/Lpools/zen/p1-setups_misc/repos/debian/d00-sid+tst+src-64/dists/sid/InRelease: ASCII text text/plain; charset=us-ascii {namei|readlink|/usr/bin/file} -f {file}... And we notice that /public/debian is a symlink and further down, this suspicious dir: drwxr-x--- zenan zenan zen Culprit identified! A quick chmod a+rx /Library/Lpools/zen and the show is back on the road. And the swanky recursive path analyzer (bash script): https://github.com/zenaan/quick-fixes-ftfw/blob/master/bin/zfile ----- End forwarded message -----

2 1

what should be the goals of an 'evolved" technological & scientific society?
by таракан 06 Jul '20

06 Jul '20

Question: what should be the goals of an 'evolved" technological & scientific society? - buying and selling the most 'popular' keywords ? - making super shiny HTML5 websites for the bags sold by Karshadian (whatever his the correct name I don't care) - watching (mostly stupid) videos on small devices everywhere at any moment of the day - ordering pizzas with a mobile device? - securing the money of the ones who steal fortunes? - making all people under strict surveillance, using all sort of monitoring devices? - putting 'IoT' smart (sic) devices into the asses of old people to measure the frequencies of their farts ? - etc... Not really, an evolved society should try to seek new ways of interacting with the universe, seeking answers about their origins, building robots to serve and help them, researching more knowledge and maybe more wiseness. And before all, travelling in space, exploring the solar system and their galaxy. Needless to say we are far from that and everyday we get seperated from that evolved society by millions of kms. Our society is people-focused... democracy as they claim... each 'people' is a god' with a beautiful body that smells good and a younger skin, a unique and beautiful creature which deserve the right to dignity and above all, a brand new smartphone provided with plenty of super programs. There are 7 billions of beautiful asses on that planet, superbs, polished and clean who 'stays at home to be safe' but is that really what we should have expected from a really 'evolved' society ? Not at least a bit more ambitions than this? Over all this, there should be a debate if digittal technology is really the most advanced thing we could do? We certainly need something like that but do we really need stuff like javascript which seems to consume the energy of so much young talents (sic). Computer are fascinating but so far all projects about 4th and 5th generations of computers were abandonned (the computers you dialog with, not program ) and since Android is becoming slowly but surely the OS of the future... I see this is a dead-end there is surely a need for something else than digital technology but what ?

1 0

Renowned Cryptographer Says His Patent Was an Obstacle for Hal Finney
by Bob Hettinga 05 Jul '20

05 Jul '20

https://cointelegraph.com/news/renowned-cryptographer-says-his-patent-was-a… Renowned Cryptographer Says His Patent Was an Obstacle for Hal Finney Okamoto explains why his “electronic cash” patent may have presented obstacles to Hal Finney’s plans to make his own electronic currency. Jul 04, 2020 Okamoto explains why his “electronic cash” patent may have presented obstacles to Hal Finney’s plans to make his own electronic currency. Tatsuaki Okamoto explains why his “electronic cash” patent might have presented an obstacle to Hal Finney in his ambition to create his own electronic currency. Six key patents Sometime before Dec. 6, 2004, Hal Finney did a search in a patent database on “blind-signature based cash systems”. On his site he posted a list of six such patents: “This might be useful for those considering implementing electronic cash.” Four of the patents are authored by David Chaum, the other two by Okamoto and his colleague at Nippon Telegraph Kazuo Ohta. Ecash patents by Dr. Okamoto & his Nippon Telegraph colleague Dr. Kazuo Ohta. Source: finney.org (via WayBack Machine) Okamoto currently serves as director of the Cryptography & Information Security Lab at NTT Research and holds over 100 patents. We asked him to explain why his patent might have presented an obstacle to Hal Finney and other cypherpunks in their ambition of creating a decentralized currency, considering that his patent involves an intermediary. Okamoto’s ecash & Nakamoto’s Bitcoin Okamoto kindly prepared diagrams elucidating the differences between the ecash system outlined in his patent and Bitcoin (BTC). Diagram: Electronic Cash described in Patent 49775595. Source: NTT Research Diagram: Bitcoin. Source: NTT Research Both solutions use public keys as pseudonymous identities and private keys to authorize transactions. However, in Okamoto’s proposal, a trusted party varies transactions, whereas Bitcoin is trustless, with all nodes verifying transactions. Trustless system — no trivial achievement Considering this key difference, one might ponder — why Finney and other pioneers were so paranoid about patent infringement? One obvious answer is that Satoshi Nakamoto’s Bitcoin proposal was the first successful framework for a trustless electronic cash system. Coming up with it was not a trivial achievement; almost 30 years passed between the introduction of Chaum’s DigiCash and Nakamoto’s Bitcoin. Did “Okamoto” give ideas to Finney for “Nakamoto?” Many believe Finney to be Satoshi Nakamoto or at least part of the team that was behind the moniker. Besides his interests, expertise and early Bitcoin involvement, another fact strongly supports this theory — being a neighbor of Dorian Satoshi Nakamoto. Considering that Google cannot return a single query for Satoshi Nakamoto before the Bitcoin proposal was publicized, this coincidence is eerie. If Finney, indeed was behind the pseudonym Satoshi Nakamoto, his familiarity with the works of Tatsuaki Okamoto might have also played a role in the choice of the alias. Okamoto told Cointelegraph that he was never a part of the famous cryptographic mailing lists and did not know Hal Finney personally.

2 1

Bulgarian Military: Russia increased the range of electromagnetic damage of its EMP weapons
by jim bell 05 Jul '20

05 Jul '20

Bulgarian Military: Russia increased the range of electromagnetic damage of its EMP weapons. https://bulgarianmilitary.com/2020/07/05/russia-increased-the-range-of-elec…

1 0

Rabushka: "as a result of the American Revolution, the tax burden tripled"
by Zig the N.g 05 Jul '20

05 Jul '20

Sadly, it is looking like the Bat-Soup Stasi is right agin - the "American" revolution was nothing but a ruse to create chaos and war debts, for greedy bankers, after which "the colony's tax debt tripled"! Now that's funny - in a true, and black comedy style of funny. Unlike the article's title though, the American revolution was no mistake whatsoever, but an extremely well calculated ploy by a few greedy and power hungry men to claim that which was not theirs, on the blood and deception of the people (admittedly by way of at least a pretence of a worthy cause of "The history of the present King of Great Britain is a history of repeated injuries and usurpations, all having in direct object the establishment of an absolute Tyranny over these States."): Was The American Revolution A Mistake? Gary North via The Daily Reckoning, https://dailyreckoning.com/was-the-american-revolution-a-mistake-2/ https://www.zerohedge.com/political/was-american-revolution-mistake ..So as a result of the American Revolution, the tax burden tripled. The debt burden soared as soon as the Revolution began. Monetary inflation wiped out the currency system. Price controls in 1777 produced the debacle of Valley Forge. ..“There Was No British Tyranny, and Surely Not in North America” Only after the price control laws were repealed in 1778 could the Army buy food again. But the hyperinflation of the Continentals and state-issued currencies replaced the pre-Revolution system of silver currency: Spanish pieces of eight. The proponents of independence invoked British tyranny in North America. But there was no British tyranny in North America. In 1872, Frederick Engels wrote an article, “On Authority.” He criticized anarchists, whom he called anti-authoritarians. His description of the authoritarian character of all armed revolutions should remind us of the costs of revolution. A revolution is certainly the most authoritarian thing there is; it is the act whereby one part of the population imposes its will upon the other part by means of rifles, bayonets and cannon — authoritarian means, if such there be at all; and if the victorious party does not want to have fought in vain, it must maintain this rule by means of the terror which its arms inspire in the reactionists. ..After the American Revolution, 46,000 British Loyalists fled to Canada and other places controlled by the crown. They were not willing to swear allegiance to the new Colonial governments. They retained their loyalty to the nation that had delivered to them the greatest liberty on Earth. They had not committed treason. The revolutionaries are not remembered as treasonous. The victors write the history books. The Boston Tea Party: A Protest Against Lower Tea Prices What would libertarians — even conservatives — give today in order to return to an era in which the central government extracted 1% of the nation’s wealth? Where there was no income tax? Would they describe such a society as tyrannical? That the largest signature on the Declaration of Independence was signed by the richest smuggler in North America was no coincidence. He was hopping mad. Parliament in 1773 had cut the tax on tea imported by the British East India Co., so the cost of British tea went lower than the smugglers’ cost on non-British tea. This had cost Hancock a pretty penny. The Tea Party had stopped the unloading of the tea by throwing privately owned tea off a privately owned ship — a ship in competition with Hancock’s ships. The Boston Tea Party was, in fact, a well-organized protest against lower prices stemming from lower taxes. So once again, I’m not celebrating the Fourth of July today.

2 2

Ars Technica: 5G was going to unite the world—instead it’s tearing us apart
by jim bell 05 Jul '20

05 Jul '20

Ars Technica: 5G was going to unite the world—instead it’s tearing us apart. https://arstechnica.com/tech-policy/2020/07/5g-was-going-to-unite-the-world…

1 0