July 2022 - cypherpunks - lists.cpunks.org

Re: FOIL DHSES-22-06-028
by Gunnar Larson 13 Jul '22

13 Jul '22

We would like to appeal this decision. On Tue, Jul 12, 2022, 9:41 AM DHSES, FOIL (DHSES) <FOIL.DHSES(a)dhses.ny.gov> wrote: > Attached please find correspondence regarding the above Freedom of > Information Law request. Thank you. >

1 1

fake free speech clowns
by punk 13 Jul '22

13 Jul '22

guess what? The biggest fascist oligarch on the planet, elono musko, isn't buy twatter after all. Meaning, musko isn't stupid enough to pay 44,000 fucking millions for a third rate website. Shocking! the only notable thing in this twatter farce is the technonazi turds like grancrap and bell, who are trumpofascists as well plus of course musco cocksuckers, and who liked to pretned that the a thing like musko is a 'free speech' 'advocate'.

1 0

Anything that the government doesn't want published, we'd like to help get published, just as a matter of principle
by zeynep＠keemail.me 13 Jul '22

13 Jul '22

"Anything that the government doesn't want published, we'd like to help get published, just as a matter of principle" John Young Does this statement include government intelligence officers and media channels?

1 0

Fwd: Once Daily Digest Email
by Gunnar Larson 13 Jul '22

13 Jul '22

---------- Forwarded message --------- From: Pam Martens <alerts(a)wallstreetonparade.com> Date: Wed, Jul 13, 2022, 11:03 AM Subject: Once Daily Digest Email To: <alerts(a)wallstreetonparade.com> Wall Street On Parade has posted a new item: Over 1,600 of the Brightest Scientific Minds in Technology Have Signed a Letter Calling Both Crypto and Blockchain a Sham https://wallstreetonparade.com/2022/07/over-1600-of-the-brightest-scientifi… By Pam Martens and Russ Martens: July 13, 2022 ~ The letter is a punch in the gut to the Wall Street underwriters who have brought billions of dollars of crypto related companies to the public markets, most of which have now collapsed in price. It makes the billionaire venture capitalists who have invested billions in crypto [...] If the hyperlink above is not active, please paste it into your browser and press "Go" to read the full article. You received this e-mail because you asked to be notified when new updates are posted. If you ever wish to stop receiving these emails from us, just email me at pamk741(a)aol.com with the word "Unsubscribe" in the subject line. Best regards, Pam Martens, Editor, Wall Street On Parade

1 0

[crazy] Framing Activists
by Undiscussed Horrific Abuse, One Victim of Many 13 Jul '22

13 Jul '22

I once went to one of those great talks where the framed activist FOIA'd their FBI file and discussed different parts of the material and their experience with large projected imagery. One the things they decribed was how the community movie screenings they put on was described in the file as having people in attendance who had killed FBI agents, as if they had discussed this at the screening. Something that repeatedly comes out is that there are said to be efforts of placing people in communities who act in ways that can worsen situations: and I'm sure many people tie these things together ...

1 0

The Gamification of Reality and its enemies
by professor rat 13 Jul '22

13 Jul '22

" So Amorpheous; what you’re saying is I could get paid for scribbling rubbish about the Matrix " No, Zero. That’s JUSTIN E. H. SMITH’s job. https://libertiesjournal.com/articles/the-world-as-a-game/ reposts etc

1 0

DARKReading: Fake Google Software Updates Spread New Ransomware
by jim bell 13 Jul '22

13 Jul '22

DARKReading: Fake Google Software Updates Spread New Ransomware. https://www.darkreading.com/attacks-breaches/attacker-using-fake-google-sof… Fake Google Software Updates Spread New Ransomware "HavanaCrypt" is also using a command-and-control server that is hosted on a Microsoft Hosting Service IP address, researchers say.Jai VijayanContributing Writer, Dark ReadingJuly 11, 2022 actors are increasingly using fake Microsoft and Google software updates to try to sneak malware on target systems.The latest example is "HavanaCrypt," a new ransomware tool that researchers from Trend Micro recently discovered in the wild disguised as a Google Software Update application. The malware's command and-control (C2) server is hosted on a Microsoft Web hosting IP address, which is somewhat uncommon for ransomware, according to Trend Micro. Also notable, according to the researchers, is HavanaCrypt's many techniques for checking if it is running in a virtual environment; the malware's use of code from open source key manager KeePass Password Safe during encryption; and its use of a .Net function called "QueueUserWorkItem" to speed up encryption. Trend Micro notes that the malware is likely a work-in-progress because it does not drop a ransom note on infected systems.

1 0

Ars Technica: New working speculative execution attack sends Intel and AMD scrambling
by jim bell 13 Jul '22

13 Jul '22

Ars Technica: New working speculative execution attack sends Intel and AMD scrambling. https://arstechnica.com/information-technology/2022/07/intel-and-amd-cpus-v… Some microprocessors from Intel and AMD are vulnerable to a newly discovered speculative execution attack that can covertly leak password data and other sensitive material, sending both chipmakers scrambling once again to contain what is proving to be a stubbornly persistent vulnerability. Researchers from ETH Zurich have named their attack Retbleed because it exploits a software defense known as retpoline, which was introduced in 2018 to mitigate the harmful effects of speculative execution attacks. Speculative execution attacks, including one known as Spectre, exploit the fact that when modern CPUs encounter a direct or indirect instruction branch, they predict the address for the next instruction they’re about to receive and automatically execute it before the prediction is confirmed. Spculative execution attacks works by tricking the CPU into executing an instruction that accesses sensitive data in memory that would normally be off-limits to a low-privileged application. Retbleed then extracts the data after the operation is canceled. Is it a trampoline or a slingshot? Retpoline works by using a series of return operations to isolate indirect branches from speculative execution attacks, in effect erecting the software equivalent of a trampoline that causes them to safely bounce. Stated differently, a retpoline works by replacing indirect jumps and calls with returns, which many researchers presumed weren’t susceptible. The defense was designed to counter variant 2 of the original speculative execution attacks from January 2018. Abbreviated as BTI, the variant forces an indirect branch to execute so-called “gadget” code, which in turn creates data to leak through a side channel. Some researchers have warned for years that retpoline isn’t sufficient to mitigate speculative execution attacks because the returns retpoline used were susceptible to BTI. Linux creator Linus Torvalds famously rejected such warnings, arguing that such exploits weren’t practical.

1 0

Hackaday: Why You Should Totally Roll Your Own AES Cryptography
by jim bell 13 Jul '22

13 Jul '22

Hackaday: Why You Should Totally Roll Your Own AES Cryptography. https://hackaday.com/2022/07/11/why-you-should-totally-roll-your-own-aes-cr… WHY YOU SHOULD TOTALLY ROLL YOUR OWN AES CRYPTOGRAPHY 24 Comments - by: Maya PoschJuly 11, 2022 - - - - - Software developers are usually told to ‘never write your own cryptography’, and there definitely are sufficient examples to be found in the past decades of cases where DIY crypto routines caused real damage. This is also the introduction to [Francis Stokes]’s article on rolling your own crypto system. Even if you understand the mathematics behind a cryptographic system like AES (symmetric encryption), assumptions made by your code, along with side-channel and many other types of attacks, can nullify your efforts. So then why write an article on doing exactly what you’re told not to do? This is contained in the often forgotten addendum to ‘don’t roll your own crypto’, which is ‘for anything important’. [Francis]’s tutorial on how to implement AES is incredibly informative as an introduction to symmetric key cryptography for software developers, and demonstrates a number of obvious weaknesses users of an AES library may not be aware of. This then shows the reason why any developer who uses cryptography in some fashion for anything should absolutely roll their own crypto: to take a peek inside what is usually a library’s black box, and to better understand how the mathematical principles behind AES are translated into a real-world system. Additionally it may be very instructive if your goal is to become a security researcher whose day job is to find the flaws in these systems. Essentially: definitely do try this at home, just keep your DIY crypto away from production servers :)

1 0

Debian Suicide Team
by Anja Xhakani 13 Jul '22

13 Jul '22

In memory of Ian Murdock we are creating the Debian Suicide Team People are dying to join us Full members are Ian Murdock and Frans Pop Apprentices are Lucy Wayland, Thiemo Seufer and Molly de Blanc. Molly has bipolar so she will join us sooner or later. This is the only team where Molly de Blanc can't expel you I am the Ubuntu underage girl I started dating the Fedora ambassador Elio Qoshi in Albania when I was 16 Elio had to resign as a Fedora ambassador but he had no problems getting a new job at Ubuntu When he started paying me to be the 17 year old sysadmin, this wasn't a payment for sex Chris Lamb started spreading gossip about abuse because he wanted an Albanian girlfriend too

2 1