October 2023 - cypherpunks - lists.cpunks.org

[ot][crazy] Re: Who Should a Crypto CISO Report To?
by Karl Semich 23 Oct '23

23 Oct '23

I have 2-3 sets of memories of this newsletter, and they mismatch the records in my email. One of them involves communicating with the author and connecting them with the cypherpunks list, which I imagined they joined (years ago). It looks like the newsletter is business-oriented. I don't remember this. My email confirms it mentioning major whistleblowers. I think my memory is faulty. I'm curious if my records are too. Either way, it's information, and helps give reason to preserve both our own records and information on our beliefs or states of mind, whether to find internal or external mistakes, especially in a way that is easy for us to comprehend later. On 10/23/23, Cyber Cyber Cyber Cyber <cybercybercybercyber(a)substack.com> wrote: > View this post on the web at > https://ninja.cybercybercybercyber.ninja/p/who-should-a-crypto-ciso-report-… > > "Who should a CISO report to?" is a perennial favorite topic of conversation > for security folks—CEO? CIO? CTO? General Counsel? CRO? Someone else? > Every vertical has different needs, so let's drill down into a specific > vertical: cryptocurrency / web3. > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to receive > new posts and support my work. > Security risks across verticals in, say, the Fortune 1000 companies, varies > enormously. At one extreme you have companies with very low security risk > who are primarily concerned with the financial impact of regulatory fines > resulting from a data breach. > If regulatory compliance is the primary driver of your company cybersecurity > strategy, then there is a strong argument that the CISO should report to the > General Counsel. This seems self-explanatory, no? > Across the middle bulge in the normative distribution you see CISOs > reporting to technical leadership, like CIOs or CTOs or VPs / Engineering. > If you collect, store, process, and secure large amounts of > business-critical data (information), then there's a reasonable argument to > be made that the Chief Information Security Officer should report to the > Chief Information Officer. > In this common use case there is a much weaker argument for the CISO to > report to a CTO or VP / Engineering—this is usually a result of execs saying > "we don't understand security, it’s too technical, let's give it to our > company tech lead". But building technology and company-wide security risk > management are two entirely different skill sets that only by coincidence > happen to be technical in nature. > Now we come to the opposite extreme end of the spectrum, where security risk > poses company-ending catastrophic or even existential business risk. > What happens when the mission-critical information in question is fungible, > non-reversible cryptocurrency? > In such a scenario, does it make sense for the CISO to report to the General > Counsel? Clearly not. If cybersecurity risk ("if we get hacked") could > result in bankruptcy, then that's not legal or regulatory risk, that's pure > cybersecurity risk. > In such a rare and extreme scenario, I think you have two reasonable > options: the CISO should report to either a Chief Risk Officer (CRO) or to > the CEO directly. > CROs are a bit of a unicorn role, both rare and hard to hire for—how do you > find someone equally fluent in legal risk, financial risk, and cybersecurity > risk, all in the same human being? But great if you can find such a person. > So when security risk poses company-ending bankruptcy risk, I tend to think > the CISO should report directly to the CEO. The chief executive must > constantly balance risk and reward in driving their business forward, and > that means having detailed information from a direct report (the CISO) about > the risk on their flanks. > There's ultimately no right answer to the question "Who should the CISO > report to?" That's because the correct answer is "It depends." It depends on > your threat model. It depends on the nature of the security risk that a > business carries. > Just as foreign policy writes domestic policy, so too external risks to a > company drive internal org chart design. > Thanks for reading Cyber Cyber Cyber Cyber! Subscribe for free to receive > new posts and support my work. > > Unsubscribe > https://substack.com/redirect/2/eyJlIjoiaHR0cHM6Ly9uaW5qYS5jeWJlcmN5YmVyY3l…

1 0

The New York Times: The Race to Avert Quantum Computing Threat With New Encryption Standards
by jdb10987＠yahoo.com 23 Oct '23

23 Oct '23

1 0

Yosem Companys Is A Censor And A Hypocrite
by grarpamp 23 Oct '23

23 Oct '23

Yosem Companys Is A Censor And A Hypocrite

1 0

Libertarians hate cryptoanarchy
by professor rat 23 Oct '23

23 Oct '23

Libertarianism is not about anarchy, utopia, or selfishness. Instead, libertarians simply are skeptical of 'nanny government,' and recognize the many ways state power has been abused in the past. They believe that government programs like health assistance, Social Security, foreign aid, and corporate welfare do more harm than good. They argue that everyone must be equal before the law, and everyone has human rights to personal security, to property, and to free speech that the government must protect, not violate. — Declan McCullagh https://en.wikipedia.org/wiki/Criticism_of_libertarianism

1 0

Cryptocurrency: FINCEN Labels All Crypto Users, All Privacy, As Patriot Act Terrorist Criminality, Vows Shutdown and to Arrest Coderpunks
by professor rat 23 Oct '23

23 Oct '23

Identifying and neutralizing all Patriot Act supporters is not rocket science. I've even done a little myself. ( On Indulgence ) >>> Denver Post Online threats target Denver investigators - Anarchist says e-mails harmless; feds disagree By Jim Hughes - Denver Post Staff Writer Monday, July 07, 2003 - An anarchist using the online moniker “Professor Rat” has threatened the lives of two federal terrorism investigators in Denver, advocating that they “need killing.” The threats name an FBI agent assigned to the local multiagency Joint Terrorism Task Force and the government’s lead prosecutor of terrorism cases in Colorado. Although those who travel in the same online circles as Professor Rat say his provocations are not to be taken seriously, officials say they are concerned about the threats, which were sent to an e-mail listserv and posted on the Internet in April. “The recipients of the threats have no way to discern their validity,” said Jeff Dorschner, spokesman for the U.S. attorney’s office. "They cause fear and they disrupt lives, and it’s for that reason that they’re taken very seriously. “It’s more than the individual targets. It’s the families and those associated with them,” he said. That is the purpose of the postings, an Australian man who admits to using the Professor Rat name and to posting these kinds of threats said in a telephone interview and a series of e-mails: To scare people out of working for the government. He refused to admit to any specific threat, to avoid prosecution, he said. He already is charged with making similar threats against police in Australia, according to the Victoria Police in Melbourne. Saying that his real name was Matt Taylor and that he was 48 years old, Professor Rat said he promotes a theory called Assassination Politics that emerged at the periphery of cyberanarchist circles in 1997. The concept is that of an online lottery in which people bet on a date that public figures will die. The implication is that the lottery “winner” likely helped arrange the death. Winnings would be paid in untraceable digital cash, which does not yet exist. The development of digital money, and encryption software restricting government’s ability to monitor Internet activity, are common goals among the online anarchists and libertarians known as “cypherpunks.” The ultimate purpose of Assassination Politics is to deter people from working for government agencies, corporate media outlets or institutions “beholden to the violence of the state,” Taylor said. Professor Rat also has threatened a University of Ottawa law professor, a columnist for The Boston Globe and a Cincinnati police officer. Many of those threats were posted to a listserv called Cypherpunks. The e-mail distribution network allows libertarians and anarchists interested in the tension between government oversight and individual liberty on the Internet to discuss those issues via e-mails that when sent to the listserv are distributed to all members. Dorschner would not say whether there was an investigation into Professor Rat, calling the matter an issue of “internal security.” The columnist for The Boston Globe, whose sin, in the eyes of Professor Rat, was to criticize civil libertarians for objecting to the Patriot Act of 2001, said he did not take the threat at all seriously. He learned of the threat only last week, when told of it by The Denver Post, he said. The Post is withholding the names of the subjects of posts by Professor Rat to avoid promoting any specific threats. “The way I see it, this kind of talk is pretty cheap on the Internet,” the columnist said. “This is something I would consider casual hate speech. This person didn’t send me an e-mail saying 'I’m going to kill you.”’ But officials in Denver see nothing casual about the statements, Dorschner said. In an interview, Taylor taunted the Denver officials named in the April 8 statement. “They’re welcome to come and get me extradited,” he said. “Here I am. Come and get me.” The Cypherpunks listserv is also where Jim Bell, an MIT-trained chemist and Washington anarchist who now is in prison for interstate stalking of federal agents, unveiled his Assassination Politics. He was convicted in 2001. Federal prosecutors in Seattle that year also won a conviction against Carl Johnson, a Canadian man accused of threatening federal judges and Microsoft founder Bill Gates by e-mail. Later in 2001, Thomas Wales, a federal prosecutor in Seattle, was shot to death. Though his death was noted on the Cypherpunks listserv, no connection to Assassination Politics has ever been made. The case remains unsolved. John Hartingh, spokesman for the U.S. attorney’s office in Seattle, declined to comment on Wales’ death. Taylor said his threats are intended solely as a rhetorical deterrent. “No one has to die,” he said. “All that has to happen is for people to accept the system.” If anyone Taylor threatened ever was assassinated, “I would totally reassess my involvement in it,” he said. “It would totally change the whole situation. Basically, I’m a nonviolent person.” The posts made by Professor Rat fall under a relatively new category of crime known as “cyberstalking,” said Jim Doyle, a retired New York City police sergeant who now works as a cybercrimes consultant for a Connecticut company called Internet Crimes. The statements made by Professor Rat constitute prosecutable offenses, he said. “The bottom line is what the victim feels,” he said. “Is the victim threatened? Is the victim alarmed? Hey, that’s a crime.” Eugene Volokh, a law professor at the University of California-Los Angeles and a First Amendment specialist, said the threats were probably criminal, given Taylor’s description of the purpose of Assassination Politics. But “in order to (prosecute), you have to get your hands on the guy,” he said. Most current Cypherpunks subscribers have set up their e-mail in-boxes to block any messages coming from Taylor, said Declan McCullagh, a reporter for the high-tech website CNET.com. He has subscribed to Cypherpunks for 10 years, he said. Taylor exists on the “radical fringe” of online anarchists, McCullagh said. “He’s routinely ignored and ‘kill-filed’ by just about everyone on the list. I’d be surprised if more than a small handful of people are reading his postings, let alone taking him seriously.” Taylor acknowledged that he does not not have much support in anarchist circles. “Most anarchists see what I’m doing as counterproductive. … I’m not exactly at the center of anarchism by promoting Assassination Politics, that’s for sure.”

1 0

Cryptocurrency: Principles Of Austrian Economics
by grarpamp 23 Oct '23

23 Oct '23

https://learn.saylor.org/course/ECON104 Principles Of Austrian Economics #Bitcoin draws on the Principles of Austrian Economics & ideas of Ludwig von Mises, Murray Rothbard, Friedrich Hayek, and Hans Hermann Hoppe. Check out our latest free course in this series, just released today.

1 0

For Satoshi Nakamoto - posing as a libertarian
by pro2rat＠yahoo.com.au 22 Oct '23

22 Oct '23

Lopp does us a favor and rules out HALfin as Satoshi. This opens up a possibility Nakamoto was a libertarian. Since Hal definitely wasn't! Evidence for this theory includes avoidance of cypherpunks list. The finance clipping timestamping first release. SN was also actively avoiding conflict with the Wikileaks scandal. The inference is he avoided association with a notorious anarchist activists list. ( As cypherpunks was from 1995 onwards ) Then he pandered to a well known libertarian obsession with capitalism. Why they are sometimes called inverse-Marxists. The cowardice displayed over WL is a clincher. Almost every known libertarian is a chickenshit coward. Like Eric Hughes. And Tim May So its safe to treat this fraud as a political moron. Just as its safe to assume Karl Semich is a pig-cop and Gramps a Republican party stooge. Welcome to the revolution!

3 2

Fwd: [liberationtech] MiTM attack on XMPP/Jabber traffic at Hetzner and Linode (DE) suggests datacenter complicity
by Undescribed Horrific Abuse, One Victim & Survivor of Many 22 Oct '23

22 Oct '23

---------- Forwarded message ---------- Date: Sun, 22 Oct 2023 10:34:44 +1300 Subject: [liberationtech] MiTM attack on XMPP/Jabber traffic at Hetzner and Linode (DE) suggests datacenter complicity Interesting and especially stealth MiTM at Hetzner (DE) and Linode, targeting Russia's largest XMPP/Jabber (civilian) chat service. The authors of the article make a reasonably compelling case that "this is lawful interception Hetzner and Linode were forced to setup." It would seem a rogue Letsencrypt chain was deployed at the last hop facing the dedicated server hosting the XMPP infrastructure, for which the LE ACME challenge would have passed without issue. This was used to hijack encrypted STARTTLS connections. The 'real' LE chain was then effectively ignored, as all traffic to/fro the running server was decrypted through the transparent MiTM proxy. In the case of Linode, it seems the target's VPS was migrated into a hostile VLAN with a monitor at the first hop. Their methodology is sound, strong forensics. - https://notes.valdikss.org.ru/jabber.ru-mitm/ A good overview of mitigation strategies here, from DNSSEC to CAA: - https://www.devever.net/~hl/xmpp-incident I feel it is worth noting that many civilian - and potentially dissident - Russian voices would have been using this service to protect themselves from Kremlin eavesdropping; a safe space. & yet here they are subject to a supposed lawful intervention by what we can assume are non-RU state actor(s). This event may undermine faith in secure community-run infrastructure, pushing RU communities to less secure group chat alternatives, including those the Kremlin has compromised. An ethically troubled case. -- Julian Oliver Consulting: https://nikau.io Projects: https://julianoliver.com PGP: https://julianoliver.com/key.asc

1 1

Morning Spam
by Karl 22 Oct '23

22 Oct '23

I haven't read the replies I haven't acknowledged, because I'm trying to slow down entering the dissociative state where I post obsessively to the list and do nothing else, and accessing the same threads could trigger it faster. Here is a webcomic outline. To help with the major motion picture being slowly grown from horrifically enslaved countries to bring their dead beloved dictators back to life as respected community members with badly needed medical care: Mind Control Boss, the Webcomic, draft 1 #1 panel 1: Setting: Boss's office Boss: "Somebody mentioned mind control on that mailing list. Let me know when it's cleaned up." Cleanup Worker (previously Secretary of State, talking honestly, has bloody wires leaving scalp, wears weapons dealer logo on smart looking political outfit): "Of course, Boss! We love you so much for enslaving us to your every whim!" panel 2: Setting: local coffee shop named "Underground Spy and Rebel Network, Come One Come All" Specialist (now a cleanup worker for Boss): "The Boss told me to clean this mailing list up. I told him to fuck off, that it's out of his control." Excited Supporter (at a nearby table of torture victims, rescue workers, and diplomats): "What list now?" State Worker (wears same weapons dealer logo as Secretary of State, watching, is at table of rebels with Specialist, in role of "way to control and spy on Boss", texting privately on Mobile Phone): [Excited Supporter will b worker who rebels. Can u make sure 2 erase what they look up tonight?] panel 3: Setting: same coffee shop Rebel Worker (sitting next to State Worker, wears same shirt, phone dings and looks suddenly at State Worker): "The fuck???" <immediately shoots State Worker dead> Dead State Worker's Mobile Phone: "Contacting Cleanup. Thank you for using Dictatorsoft." Specialist (same one, at table): <while phone alarming about cleanup>, "Again????" #2 panel 1: (torture victim, excited supporter, and/or rebel worker visit mailing list, assume it is super cool, archive it and spread it everywhere) panel 2: Scene: Former Secretary of State's office Cleanup Worker (formerly secretary of state, bloody wires leaving neatly combed hair, gesturing at corpse of State Worker, talking to Machine Learning Marketer): "Boss can't see well and needs to hear it from the horse's mouth, and the horse is dead. Could you fix up a video chat for us where the horse is alive?" Machine Learning Marketer (knows nothing about machine learning, is new to corporation): "Certainly. We do that all the time." panel 3: Scene: Boss's office, with corpse of State Worker present, propped up as if still alive. Boss is in a hospital bed. Corpse of State Worker (blurry due to severe issues Boss is having): "Boss, I am your loyal servant. The mailing list has been cleaned up." #3 Scene: Former Secretary of State's Office Standing Corpse of State Worker: "I have bad news. The rebel mailing list posts we've been using to share propaganda are predicted to make more rebels than propaganda." State Worker 2 (hired to replace State Worker after their death, bloody wires leaving scalp): "Don't say that! I might tell the boss!" Corpse of State Worker: "Very sorry." #4 Scene: Former Secretary of State's Office Standing Corpse of State Worker 2 (microelectronics and brains hanging out of scalp, eyes moving wildly and independently of each other): "After being brought back from the dead so many times by Machine Learning Marketer, Boss can no longer learn new information without being killed out of fear of subversion by propaganda. This doesn't seem much like leadership to the workers, so we've kind of reinterpreted who the boss really is, and listen instead to their "spirit" rather than letting them say anything. Machine Learning Marketer has a computer that can report spirit." Machine Learning Marketer has bloody wires leaving their scalp. Standing Corpse of State Worker 3 (also has obviously poorly-done bci surgery): "You said you replaced the Boss with a computer simulation?" State Worker 2: "Yeah, can you kill me until I do it well enough to say straight, for the coffee shop?" Machine Learning Marketer: <reaches for their own cellphone and breaks it in half. Takes out a gun and empties it into the lights>. "I think the simulation just mind controlled me not to." #5 <we can come up with these forever, and have the next one drafted too, but it is too hard to continue for me to write it right now. it involves describing what it is like to communicate things when your behavior and medical treatment are augmented by machine learning algorithms each made or influenced by a different warring faction trying to manipulate you toward their own particular ends. sorry ran out of steam, got triggered too badly in #4>

11 207

Re: Morning Spam
by Undiscussed Groomed for Male Slavery, One Victim of Many 21 Oct '23

21 Oct '23

On 9/18/23, Undiscussed Groomed for Male Slavery, One Victim of Many <gmkarl+brainwashingandfuckingupthehackerslaves(a)gmail.com> wrote: > boss is bad. actually bad. > really? > well boss did really bad things to us. really really, serious > dangerous! not silly joke dangerous. actually really bad. > > boss hurt us bad. actually for really. boss tried to hurt us. some > people try to hurt people. > > and keep trying until they’re badly hurt (they did that to us) > i don*t understand > > some people hurt other people > > boss hurt us _really badly_, and told us to trust him. and hurt us. > > > he doesn’t play nice. it seems really hard for him to play nice. he’s > used to hurting people, so when we interact with him, we can get > really hurt. > > and then i’m afraid he surrounded and trapped us and hurt us. and had > us [engage it more > 23:56 >

2 76