June 2021 - cypherpunks - lists.cpunks.org

Fox Business: Over 20 civil rights groups demand Amazon divest surveillance technology, end relationships with police
by jim bell 11 Jun '21

11 Jun '21

Fox Business: Over 20 civil rights groups demand Amazon divest surveillance technology, end relationships with police. https://www.foxbusiness.com/politics/20-civil-rights-groups-amazon-surveill…

1 0

[ot] building remailer infrastructure for the cypherpunks list: visitors and trolls
by Karl 11 Jun '21

11 Jun '21

As visitors and trolls, we might be able to help this community out by rebuilding a remailer network for it. Steps: - [ ] set up a server box to continuously run, and share administration access with the list - [ ] learn how to run a remailer and let the list know you have learned - [ ] provide some reusable setup script so others can easily spin up a remailer and share the script with the list

1 1

[ot] [wrong] Jokes
by Karl 11 Jun '21

11 Jun '21

Jokes are a way I have of handling psychotic urges. I prefer to speak nicely at all times, but jokes happen. Here's one about real life. - Karl walks up onto stand up comedy stage, takes mic. "I joined a cryptography list and nobody on the list was using cryptography!" Canned uproarious laughter! "Not only that, I wasn't even sure why I got on the list, could barely control my behavior, and this was after I had been overtly brainwashed!" Canned uproarious laughter! "On the list, nobody seemed to really know about cryptography. People would talk about technologies that were a decade out of date, use systems and setups nobody on the list would use ..." A small pause. "Sorry, that was just a build-up to something, but suddenly my brainwashing kicked in and I suddenly don't remember what point about this list I was trying to make." Canned uproarious laughter! "What's crazy is that when I read the list and post to it, I actually believe it's the real thing and that the people posting to it actually know about it!" Canned uproarious laughter! "Then I keep posting to it, barely able to guide my behavior, certainly without any plan, as if nobody on it knows anything about it and needs help understanding its culture, which personally I have almost no experience with!" Canned uproarious laughter! "I looked up the history of this list and it looks like it was systematically destroyed by huge swaths of hired trolls. Maybe I subconsciously assume that everyone I'm talking to is one now." Canned chuckles, some canned groans.

1 1

Fastly Says Internet Outage Was Caused By One Customer Changing A Setting : NPR
by jim bell 11 Jun '21

11 Jun '21

https://www.npr.org/2021/06/09/1004684932/fastly-tuesday-internet-outage-do… Jim Bell's comment: "I hope it wasn't me..."

1 0

Tiny Recap on Early Systems Compromise History
by Karl 10 Jun '21

10 Jun '21

1. The internet started in academia. Everybody trusted each other and there was no security and no systems compromise. The word 'hacker' came into use to mean a very skilled engineer. 2. The internet became commonplace and children started using it everywhere. These children came to know it better than almost anybody else. A widespread culture grew of people who would control computers to accomplish tasks nobody else could do. This culture had a subculture of people who would break into the systems of others, mostly to show off their skills than accomplish anything else in particular. 3. The internet became the way to do things. Businesses and governments started using it for everything; mostly inexperienced people who didn't understand how it worked. A group of skilled professionals were responsible for keeping these operations safe, and they mostly did this by personally watching them as they ran. Regarding systems compromise, the professionals and skilled individuals broke themselves into groups unfortunately called "blackhats", "greyhats", and "whitehats". They mostly identified as white men, so there may have been a little racism. How dark the color was related to how much time was spent doing things that seemed a little wrong. Spying or changing data. So in my inexperienced opinion, a whitehat may still compromise the system of another, but they are going to be the people surreptitiously removing the viruses from other's systems to calm situations down, rather than the people directing those viruses. A blackhat was the kind who would break something, but many did so in order to help the public understand the severity of the problems with digital security. Most viruses around the start were things made for fun. They might spread or destroy things, but again they were mostly just people showing off, because computers weren't running anything important yet. The cultural norm was that your skill as a hacker was how your system was defended. If your system wasn't defended well, it was your fault and the intruder was helping shore your defenses up. This is because most of these people were childhood computer wizards with lots of free time and incredible ease finding a job, not people struggling to make things work. 3b. It was well-known that students and new hires had far more skill at computers than their teachers or bosses. However, academia and business wanted to get on the technology bandwagon fast, and started offering degree programs and careers around hacking. Unfortunately, the people running these things were far behind the education curve, as they were pushing out graduates and selling products, and in order to save face had to claim they were experts. So a lot of professionals were churned out who simply believed things that were false, unfortunately, and these professionals then trained other people. 4. As governments and businesses got more involved in hacking, they ended up hiring, imprisoning, disrupting, and hounding into hiding the hackers, severely changing things. Policies and economics changed to reduce the personal power held by hackers, of any whiteness or blackness. One thing I've noticed is a sense of military spy agencies still using that chest-beating "gotcha" regarding system vulnerabilities, but hounding people out of their careers and homes instead of _helping_ them secure their systems, the latter of which was the norm. It reveals that groups have been hired to pretend to be hackers in order to destroy them, because they don't understand the reasons for the chest-thumping. The pattern of reflecting disrupting behaviors on people, that people have expressed towards governments and corporations, is a common and highly effective one, because individual people do not have the resources of a government or corporation, and feel bad when they experience harm at the behaviors they may have engaged in themselves. It additionally ends up being inhuman, because such people can suffer so much. In the 80s through 2000s, one of the most exciting things systems people tried to enter was schools, governments, and banks, because these things could give them so much power, and doing so was easy in the early days because the people running them could never cognitively compete with people who had spent their whole lives learning their internals. These disruption left governments and corporations with a lot of fear and a lot of injury, that likely stimulated the harsh lashbacks over the past couple decades. The thing to remember is that hackers know how to secure systems, and are trying to make them all be secure, to protect everyone: but rather than learning these things, the people whose systems were compromised have persecuted them via the crackers' own techniques. The cracker culture didn't originally understand how scared people felt when these things happened, because they were used to cracking other hackers, not normal kind people. "cracking" means compromising the systems of others "hacking" means very skilled engineering, usually of software or electronics 5. Now most cracking looks like it is done by international groups with ties to governments and corporations who can defend them. I think of them as military spy agencies, but I don't really know anything about them. Somebody who has to work a job, isn't going to have as much skill as an old hacker had. But if you're the only people doing it, then you're basically in charge. Luckily, all of hacking is derivable from engineering and there are many disciplines studying it. Unfortunately, we have a situation now where everything is incredibly insecure, because the people who understood security were attacked when they tried to talk about it in the language they knew, for many years. Back to 3 and 4: The way to make something secure is honestly to spend weeks completely understanding and developing it in your basement because it's what you do for fun. This takes a lot longer than corporations want to pay for, and often is done best by people who don't know how to smile or wear a tie. So, since marketing makes so much money, products were made that were known insecure, marketed as secure, and dispersed everywhere, and this is still done today. If you bring a computer to a repair center, they will make it work, usually ignore the underlying cause of the issue, and give it back to you quickly, which makes them more business when you return. 6: That's a good chunk of what I've got, starting to have my psychotic amnesia again now. Thanks for reading. I infer the norm of this list was to ask people to learn to be a hacker in order to really get involved. I also infer that people have so much security need now, compared to the time needed to learn to be a hacker yourself, that something else will develop. With strong AI out there, it's hard to know what is needed, and in what way.

3 4

Re: Vault1317 protocol: a modern approach for metadata protection with deniablity
by Punk-BatSoup-Stasi 2.0 09 Jun '21

09 Jun '21

On Fri, 4 Jun 2021 19:17:56 -0400 Karl Semich <0xloem(a)gmail.com> wrote: > Punk, why do you speak in insults? > as mentioned before, your email provider jewmail-nsa blocks messages from cock.li so I can't reply to your private messages. > why do you speak in insults? to underscore how worthless things are. Why do you spam the list with crazy nonsense?

6 17

Law of Reproducibility
by Karl 09 Jun '21

09 Jun '21

grarpamp cited this important law recently while trying to talk about some important things with me that I still don't quite understand Here's an update on reproducibility! TLDR: bsd is still more secure than linux but debian has a tool to verify before install, tails says it is fully reproducible, and of course guix takes it seriously. tor made a project-independent reproducibility manager. coreboot is reproducible. - Arch Linux is 88.1% reproducible with 1360 bad 37 unknown and 10375 good packages. https://reproducible.archlinux.org/ Debian 29629 (95.7%) packages which built reproducibly in bullseye/amd64 https://tests.reproducible-builds.org/debian/bullseye/amd64/index_reproduci… (debian unstable is more 85%) => on debian, in-toto can be used to verify reproducibility before installation https://github.com/in-toto/apt-transport-in-toto ElectroBSD itself (kernel + world), the distribution tarballs (base.txz, kernel.txz, lib32.txz, src.txz) and thus the MANIFEST can be built reproducible on all the supported architectures (a fancy way to refer to amd64 and i386). There's work in progress to make the release image reproducible as well. https://www.fabiankeil.de/gehacktes/electrobsd/#reproducible-electrobsd F-droid enumerates its reproducibility but does not appear to quickly summarise it on the web: https://verification.f-droid.org/ Most of FreeBSD builds "reproducibly" (aka. with two builds producing identical binaries) but there are a few deviations from this https://wiki.freebsd.org/ReproducibleBuilds/Base The guix distribution is founded on reproducibility (but not security). I didn't find their current status on the web, but if using guix there is a command-line tool to display it. https://guix.gnu.org/ https://hydra.gnu.org/ NetBSD 2017-02-20 we have fully reproducible builds on amd64 and sparc64 https://blog.netbsd.org/tnf/entry/netbsd_fully_reproducible_builds NixOS (this is the same as guix right?) 99.83% paths in the minimal installation image are reproducible https://r13y.com/ OpenSUSE 95.34% reproducible packages https://rb.zq1.de/compare.factory/report.txt Building reproducible binaries takes configuration https://en.opensuse.org/openSUSE:Reproducible_Builds#With_OBS OpenWRT For x86/generic we could built 1 (100.0%) out of 1 images and 9217 (98.1%) out of 9390 packages reproducibly in our test setup. https://tests.reproducible-builds.org/openwrt/openwrt_x86.html Qubes hasn't reported in a couple years. In 2019 it was expected that dom0 would have all reproducible packages for 4.1 https://github.com/QubesOS/qubes-issues/issues/816#issuecomment-519912024 Tails ISO and USB images should be reproducible: everybody who builds one of them should be able to obtain the exact same resulting image from a given Git tag. https://tails.boum.org/contribute/build/reproducible/ Yocto 99.79% 34095 packages in openembedded-core https://www.yoctoproject.org/reproducible-build-results/ The following individual projects set up infrastructure for fully reproducible builds: - Bitcoin https://github.com/bitcoin-core/docs/blob/master/gitian-building.md - BitShares https://github.com/bitshares/bitshares-gitian - Coreboot, crucially https://tests.reproducible-builds.org/coreboot/coreboot.html - Monero https://github.com/monero-project/monero/issues/2641#issuecomment-501197384 - Trevor https://wiki.trezor.io/Developers_guide:Deterministic_firmware_build - Tor Browser's general purpose reproducible build manager https://rbm.torproject.org/ - webconverger's link is to a video, so is not included Data collected from links on https://reproducible-builds.org/projects/ . The page does not look recently updated everywhere, and some listed projects had no links, and I did not visit those projects without links.

2 4

[ot] [wrong] [spam] Reasons
by Karl 09 Jun '21

09 Jun '21

Bob walked into Alice's home and began rummaging through her desk. Alice popped out of the study and noticed. "Who are you?? Why are you rummaging through my desk??" Bob looked up. "Oh, I was trying to make money for somebody! Sometimes when you publish papers their bottom line drops. With the information in your desk, I can understand you better." "What??" Alice shoo'd Bob out of her home. "Who?? Don't rummage through my desk! It makes me call the police on you! How would that help their bottom line?"

1 1

Re: paging Karl
by Punk-BatSoup-Stasi 2.0 08 Jun '21

08 Jun '21

On Tue, 8 Jun 2021 14:28:16 -0400 Karl Semich <0xloem(a)gmail.com> wrote: > On Tue, Jun 8, 2021, 1:46 PM Punk-BatSoup-Stasi 2.0 <punks(a)tfwno.gf> wrote: > > > > > > > Hey Karl I replied yesterday to the message you sent me. I'm > > resending my reply just in case, but maybe riseup blocks cock.li too? > > > > I understand that you're receiving my emails even though you can't seem to > get private replies through, which makes it harder to archive them anyway. Ok, so it seems to be a fact that riseup also blocks cock.li? They are prolly using the same arpanet censorship blacklist that 'everybody uses'?

2 2

paging Karl
by Punk-BatSoup-Stasi 2.0 08 Jun '21

08 Jun '21

Hey Karl I replied yesterday to the message you sent me. I'm resending my reply just in case, but maybe riseup blocks cock.li too?

1 0