July 2023 - cypherpunks - lists.cpunks.org

HP Cuts Estimated Autonomy Loss By $1B For Damages Trial
by Gunnar Larson 20 Jul '23

20 Jul '23

HP Cuts Estimated Autonomy Loss By $1B For Damages Trial By Richard Crump An accountancy expert for Hewlett Packard has cut the U.S. tech giant's estimated loss in its multibillion-dollar fraud case over its acquisition of British software company Autonomy by $1 billion ahead of a damages trial slated for the end of 2023. Read full article » | Save to favorites » https://www.law360.co.uk/financial-services-uk/articles/1701290?nl_pk=4fb41…

1 0

[crazy?] completely neutered self-signed certificate verification administering akash hosting providers?
by Undescribed Horrific Abuse, One Victim & Survivor of Many 20 Jul '23

20 Jul '23

Of course I should talk with akash, which is my plan, but I'm posting here at the moment. Akash is a blockchain hosting provider. They recently added support for GPU compute. I'm writing code to verify connections to akash nodes by renters. Provider certificates are registered on-chain and used for client communications, but I don't understand how the protocol produces security. The code clients use for verifying a provider certificate when executing administrative actions is here: https://github.com/akash-network/provider/blob/44c85af39a56a43830efbdcbe7a2… I don't understand how the verification provides security. -> I am not very familiar with TLS and X509 and am very, very, very confused. <- The first and primary authentication is that the common name is the account address in bech32 format. It reports a hijacked certificate if this is not the case: > // validation > var prov sdk.Address > if prov, err = sdk.AccAddressFromBech32(cert.Subject.CommonName); err != nil { > return errors.Wrap(err, "tls: invalid certificate's subject common name") > } > > // 1. CommonName in issuer and Subject must be the same > if cert.Subject.CommonName != cert.Issuer.CommonName { > return errors.Wrap(err, "tls: invalid certificate's issuer common name") > } > > if !c.addr.Equals(prov) { > return errors.Errorf("tls: hijacked certificate") > } I don't understand how this helps prove the provider owns the certificate. Couldn't anybody set the common name of a certificate to an account address? Wouldn't it be important here to sign material with the private key of the account, rather than using the address? Then it verifies the certificate is active on-chain, but it compares only the serial number rather than a fingerprint: > // 2. serial number must be in > if cert.SerialNumber == nil { > return errors.Wrap(err, "tls: invalid certificate serial number") > } > > // 3. look up certificate on chain. it must not be revoked > var resp *ctypes.QueryCertificatesResponse > resp, err = c.cclient.Certificates( > context.Background(), > &ctypes.QueryCertificatesRequest{ > Filter: ctypes.CertificateFilter{ > Owner: prov.String(), > Serial: cert.SerialNumber.String(), > State: "valid", > }, > }, > ) > if err != nil { > return errors.Wrap(err, "tls: unable to fetch certificate from chain") > } > if (len(resp.Certificates) != 1) || !resp.Certificates[0].Certificate.IsState(ctypes.CertificateValid) { > return errors.New("tls: attempt to use non-existing or revoked certificate") > } I don't understand how this helps prove the provider owns the certificate. Couldn't anybody set the serial number of a certificate to the value active on-chain? Wouldn't it be necessary to use a digest of the certificate to verify it is the same one? Finally, it places the certificate in a pool of its own, and uses that same pool to verify that same certificate: > certPool := x509.NewCertPool() > certPool.AddCert(cert) > > opts := x509.VerifyOptions{ > DNSName: c.host.Hostname(), > Roots: certPool, > CurrentTime: time.Now(), > KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, > MaxConstraintComparisions: 0, > } > > if _, err = cert.Verify(opts); err != nil { > return errors.Wrap(err, "tls: unable to verify certificate") > } I don't understand how this helps prove the provider owns the certificate. Couldn't anybody craft a certificate that verifies itself? Shouldn't there be some cryptographic path between the on-chain material and the off-chain material? Note: every provider and every provider's hostname can be enumerated on-chain, so an attacker can easily identify if there are providers that are easy to intercept, or enumerate all providers to intercept them all. (Might be this cli command, haven't verified: https://github.com/akash-network/docs/blob/master/cli/provider-services_que… ) To me it looks like this system could have the function of making it very easy to intercept and mutate traffic between all akash providers and clients, optionally presenting a fake provider to clients that pretends to be the real one.

1 2

Anarchist thought in the Swiss border town that hosted a definitive break with Marxism.
by professor rat 20 Jul '23

20 Jul '23

July 19th sees the first sessions of a five-day celebration of anarchist thought in the Swiss border town that hosted the visionaries of a definitive, and historic, break with Marxism. https://anarchistnews.org/content/150-years-st-imier-thriving Reposts rinse repeat and kill Marxist-Communism off forever

1 0

‘The narcissism of small differences’ Is the feminist movement tearing itself apart?
by Gunnar Larson 19 Jul '23

19 Jul '23

‘The narcissism of small differences’ Is the feminist movement tearing itself apart? This was one of the questions that Stacey Abrams, a board member of U.S. nonprofit National Democratic Institute, and Maliha Khan, the CEO at Women Deliver, tackled in a wide-ranging fireside chat, which included discussions on empowerment from television shows “Ted Lasso” and “Buffy the Vampire Slayer,” during the second day of the Women Deliver conference. Khan highlighted how “the narcissism of small differences” — an unwillingness to collaborate with those you share minor differences with — is shredding the feminist movement. “It’s like some evil genius sat there and said, ‘How can I get the feminists to fight each other? Get them to fight over who’s a woman.’ And that, to me, is a masterful strategy on their part and a foolish naivety on our part that we’re falling into it,” Khan said. There shouldn’t be a “sole narrative” within movements, as that restricts space for conversation and questions — and one of the defining elements of the Women Deliver conference this week is the space being given to various groups, Abrams responded. This also relates to criticism around the decision for Hungarian President Katalin Novák to speak at the opening ceremony, which we reported on yesterday. While the organization said they pushed back on the decision to invite her, Women Deliver ultimately did co-sign the invitation and decided on speakers collaboratively with the government of Rwanda, the host country. “As a feminist movement, we have to be inclusive, and we have to be pragmatic. We don’t always choose the partners that we are working with,” Khan told Devex. https://t.devex.com/dc/kyXVoDpAY__Vu56MNr4POlZpa6kaU9C80Z2gMobbDY-u4JOYTdZX…

1 0

Panel Orders Pa. Senate To Explain Redacted Legal Records
by Gunnar Larson 19 Jul '23

19 Jul '23

Panel Orders Pa. Senate To Explain Redacted Legal Records By Matthew Santoni Pennsylvania legislators can cite attorney-client privilege to redact the reasons they hire outside legal counsel from public records, but the state Senate needs to go back and more thoroughly justify its redactions in response to a pair of reporters' requests for records of legislators' legal spending, a state appellate panel said Tuesday. 2 documents attached | Read full article » | Save to favorites » https://www.law360.com/governmentcontracts/articles/1700948?nl_pk=fa7fa7d8-…

1 0

Ex-Lockheed Atty Lied To Bolster Retaliation Suit, Judge Says
by Gunnar Larson 19 Jul '23

19 Jul '23

Ex-Lockheed Atty Lied To Bolster Retaliation Suit, Judge Says By Ivan Moreno A federal judge has dismissed a retaliation lawsuit from a former Lockheed Martin attorney, saying she lied under oath about her employment and income after she left the company, which would have affected any damages she received if she had won or settled the case. Order attached | Read full article » | Save to favorites » https://www.law360.com/insurance/articles/1700673?nl_pk=710b6860-f64b-4b2d-…

1 0

NY Children's Legal Services Workers On Strike
by Gunnar Larson 19 Jul '23

19 Jul '23

NY Children's Legal Services Workers On Strike By Tracey Read Staff members of the Children's Law Center in New York City are on strike to fight for better wages and working conditions, the UAW announced Monday. Read full article » | Save to favorites » https://www.law360.com/newyork/articles/1700889?nl_pk=00e0f28d-575b-4889-8d…

1 0

SEC Fines Fifth Third Securities Over Muni Bond Disclosures
by Gunnar Larson 19 Jul '23

19 Jul '23

SEC Fines Fifth Third Securities Over Muni Bond Disclosures By Sydney Price The U.S. Securities and Exchange Commission announced Tuesday that Ohio-based Fifth Third Securities Inc. has agreed to pay over $700,000 to settle claims that it failed to comply with municipal bond offering disclosure requirements under the Securities Exchange Act. Order attached | Read full article » | Save to favorites » https://www.law360.com/banking/articles/1701157?nl_pk=99a2a594-20ad-4b2f-a2…

1 0

Feds Seek To Seize $58M Linked To Crypto-Tied Deltec Bank
by Gunnar Larson 19 Jul '23

19 Jul '23

Feds Seek To Seize $58M Linked To Crypto-Tied Deltec Bank By Aislinn Keely U.S. law enforcement is in the process of recovering $58 million from a bank account linked to the crypto-tied Bahamian institution Deltec Bank in connection with an ongoing wire fraud case, according to newly unsealed court documents. 2 documents attached | Read full article » | Save to favorites » https://www.law360.com/banking/articles/1700992?nl_pk=99a2a594-20ad-4b2f-a2…

1 0

EX-Wells Fargo Exec Says Jury Should Hear Retaliation Case
by Gunnar Larson 19 Jul '23

19 Jul '23

EX-Wells Fargo Exec Says Jury Should Hear Retaliation Case By George Woolston Jurors should decide whether it was a coincidence that a former Wells Fargo vice president was disciplined for the first time in her 27 years at the company and then fired in the weeks and months surrounding her testimony before the Office of the Comptroller of the Currency about corporate misconduct, a federal judge was told Tuesday. Motion attached | Read full article » | Save to favorites » https://www.law360.com/banking/articles/1700951?nl_pk=99a2a594-20ad-4b2f-a2…

1 0