- cypherpunks - lists.cpunks.org

"contact tracing" apps - individual v collective rights - Utah Rejects Apple-Google Tracing Technology for Local Start-Up Application
by Zenaan Harkness 14 May '20

14 May '20

The thought arises as to whether and how this type of front running might be useful to individuals and "self chosen" groups/collectives of people: Utah Rejects Apple-Google Tracing Technology for Local Start-Up Application https://sputniknews.com/world/202005131079296065-utah-rejects-apple-google-… Apple and Google are involved in the development of a joint contact-tracing app for download in order to alert people who may have been in contact with others who have tested positive for the coronavirus. As the tech giants jump into the field of public health, local state start-ups have also stepped up to aid medical departments. ... The first principle is our existence, and our right to survival - to do those things needed to maintain our existence. The second principle is our will, our freedoms of thought and communication and action in this world, whether or not that action is directly related to our survival. Next, our existence appears in a world or realm with, apparently, other 'fellow' Souls on this journey of life - and they too have or "are with" the same rights as we ourselves are. In dignity, one cognizes a duty of care to one another - not only to the living of our own rights, but to the upholding of the rights of those around us, that we might all enjoy thriving in our (apparent) 'collective existence'.

1 0

Keywords
by Karl 13 May '20

13 May '20

There is a way to resolve every possible conflict such that all parties involved are fully satisfied. If you want to know that more, here is a 30-page booklet that introduces one of those ways: https://bico.media/9618fe4b03011b167377ed7bb76a8165ca43be6162b1990cc6320547… Posting this booklet is a copyright violation. The author is dead, and spent his life as an international peacemaker. He proposes in his works that laws and punishment are harmful. On Mon, May 11, 2020, 5:58 AM grarpamp <grarpamp(a)gmail.com> wrote: > tx/rx a hello Tiananmen 1989 65 in blockchain > message data field. Your ass is going to jail, be in database, for long > time. > grarpamp, I was wondering if you were available at all to explain the present-day relevance of this phrase about a protest in china? I tried out posting it to the bitcoin cash blockchain at https://explorer.bitcoin.com/bch/tx/3c3fdf38fba349eddd3a80698ceb65379e54c77… . I used https://memo.cash/ to do this. Other than Occupy Wall Street, one of my issues is around sharing an Earth Liberation Front pamphlet in a space for homeless activists I was hosting around 2014. ELF used to be a banner spread around using nonviolent destruction to protect crucial ecosystems. I've heard it produced severe lifelong targeting for those who acted strategically behind that banner, or spread the effort to others. Leslie James Pickering's website on using the freedom of information act to acquire proof that he was treated as running terrorist cells when he was living a public life of nonviolent activism, is no longer online, but he still offers his workshop showing the FBI documents sometimes and has some of them on facebook. This looks like the remaining website bit on using FOIA for activists. It no longer discusses Leslie: https://burningbooks.com/pages/foia A blockchain message I would die before posting, out of fear of being harmed by authorities, might be something like "burning empty buildings to stop ecocide and genocide is not illegal. it is morally required. -ELF" maybe with more caps. Karl Semich >

1 0

(no subject)
by Bill Roffmann 13 May '20

13 May '20

The consequences of invention are that some totalitarian will not like it. They don't want change. The side effect of posting is that one might get doxxed. I think that's why people need cryptography. Because otherwise our privacy would be violated, and we would become easy victims for totalitarians.

2 1

diff gurus? - howto alternate src/dst lines (do not aggregate) for pairwise line review of text document files?
by Zenaan Harkness 13 May '20

13 May '20

Any diff (or git diff) gurus around? I often review one text document file against an updated file, and wish to view each pair of lines for differences, so are there some combo of options to diff or git diff, to show the diffs in a repeated pair-wise fashion - i.e., just a single old line, followed by its modified new line, then repeat (and never group old lines, or new lines)? Default diff and git diff behaviour is to aggregate as many 'old' lines as have been changed in localised group of lines (the "-" minus lines), followed by an aggregate of the correspondingly changed 'new' lines in a group (the "+" plus lines). When groups of lines are aggregated like this, it is hard to do a pairwise review of each of pair of lines (old line, immediately followed by new line). Sometimes this would even be beneficial when reviewing code, but mostly for reviewing text documents. TIA,

2 1

SkyTube (for Juan e Mirimir)
by Cecilia Tanaka 13 May '20

13 May '20

My dearest Juan, Today discovered I am really good in a new programming language, woohoo!!! :D <https://redd.it/gh5dlx> Did you already try to use the SkyTube? I downloaded it tonight and I am still trying it for curiosity. What do you think, dear? <https://skytube-app.com> Now I need to get some sleep before telling to Mirimir my last heroic saga, hihihi... ;) Love you sincerely, guys! Take care and do not dare dying before me, please! <3 Ceci ---------- Loving. Caring. Sharing. Being Excellent To Each Other And To Our Hackerspace. <3 ---------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

1 0

T shirt facial recog disguise?
by jim bell 13 May '20

13 May '20

New t-shirt design promises to disrupt facial recognition cameras https://mol.im/a/8313221 via http://dailym.ai/android

1 0

Surveillance: Thought Control Wants To Know Your Thoughts
by grarpamp 13 May '20

13 May '20

https://www.thedailybeast.com/mitch-mcconnell-moves-to-expand-bill-barrs-su… https://s3.amazonaws.com/demandprogress/letters/Coalition_Support_for_Daine… see: EARN-IT Act

1 0

Nextgen Traffic Analysis Resistant Overlay Networks (re: tor replacement box)
by grarpamp 12 May '20

12 May '20

>> https://lists.cpunks.org/pipermail/cypherpunks/2020-May/080509.html >> mid: CAD2Ti282noLJEugQ8dQ6BAnbfxdz8DDy1xUpNAXSXMxHNN Being potentially applicable to a more abstract generic overlay transport network handling modular applications, one perhaps being 'replacing tor'... bell writes: > 'chaff' might have been a problem if > the people who host the nodes had some limited-data Internet service, but I > am aware that Centurylink now offers 1 gigabit service for $65 monthly, and > I think that service has no monthly data limit. (their slower services have > a 1 terabyte montly limit). That should be plenty to allow for generous > chaff. Things maybe different from the notion that paying high speeds, enables sufficient chaff, enables sufficient security. Data limits vs bitrate vs network fill chaff vs security. A network normally filled fulltime during user-idle time with right-of-way-Yielding chaff, then yielding way dynamically to user-not-idle traffic demand of right-of-way-Having wheat, an equation is... (rowY chaff + rowH wheat = at all times ensuring the provisioned line rate is full) ...that is self enabling, regardless of bitrate, caps, or money. If user has a 'data limit' specified as a quantity (typically Bytes in a period), they can generally save some quantity for later consumption by... - turn on client, use for whatever, turn off client ...but client must still conform to equation above when running, else no security improvement over todays existing overlay networks. 3TiB/mo = 100GiB/dy = 10Mbps Any data quantity limit per time period breaks down as above into an available constant bitrate. If that bitrate is not enough for user to do whatever within, say voiceconferencing at stupidly offensive codec bitrates, then they must play the on/xfer/off game above to convert more saved quantity into now bitrate, this is simple physics. They only have bitrate up to the max they got from ISP, the maximum even then is up to the hard physical link speed PHY. Both of which are usually higher than any data quantity limits the user bought and got provisioned because the ISP wants to rape user's bill for Bytes (the ISP aggregates and only deals in bitrate pipes upstream anyway, Byte caps are just counters triggering management scripts over pipes). Point is, constant bitrate <=translate=> data quantity. And the constant background of chaff would yield its way packet by packet on the fly upon demand of the quantity of user's wheat flow, whether the demand be for 0% up through 100% of the line, all [re]clocked back out the NIC. Whatever the %, and for the varying duration and amount of its demand, that wheat is in fact become part or all of the fill traffic needed to prevent traffic analysis across the network. Security of the net requires all network nodes to always enforce the above equation when running. So there is probably less notion of this 'allow for generous chaff', only the notion of if the user has purchased enough capacity to do what they want. If they didn't buy enough, nothing will let them dodge their provisioned physics. This physics is no different than with Tor, I2P, bittorrent, IPFS, BTC, this model or anything other, or even plain old raw websurfing straight out user's NIC to their ISP to YouTube. 1Gbps = 300TiB/mo = $65/mo 1TB/mo = 3Mbps = $?/mo Only one of those two ISP plans will allow the user to do 10Mbps of demand. The network is still secure during their use of it regardless of which plan they choose or how they choose to use it. If talking about 'hosting' nodes, meaning configuring them up as transit nodes, possibly in addition to user's own use of them as endpoints, the same equation still applies. People still too often think of chaff by the old fashioned models, they still assume chaff can only be in addtion to or somehow taking up space for or blocking out wheat... the equation above offers a new dynamic yield-right-of-way model to think about. All nodes, whether end user endpoints or any other type, must generate equation conforming fill of their entire virtual connection rates into the overlay [1], else... - Pairs of endpoint traffic patterns can still be matched up. - Overlay cloud will have quieter/unregulated paths that will eventually get randomly chosen by endpoints to path through yielding a traceback match. ... tor tries to game these with noise and aggregation, but that may not be sufficient. Nodes auto negotiating bandwith rates among peers, enforcing those contracts and [re]clocking expectations, else dropping them out as suspect, still applies as usual. Migrating end users from any of today's overlays would set one new thing... the end users subject to data caps would configure their node to sit idle until it detects their call for the network, or just turn it off. Both those and unrestricted users gain access to some more analysis resistance in usual transparent-tor-like sort of way. The model might not depend or care about how traffic moves around inside the network, or what the apps it carries are. It maybe possible to apply to any existing or new overlay network as an external function managing its traffic over the NIC to/from its peer nodes on clearnet, like in old ATM cell bucket brigade fashion. foreach bucket in negotiated_clocked_rate if demand then send demand else send chaff This scheme probably rubbish anyway. [1] The real pipe bought from ISP might have some virtual rates carved from it by user for other clearnet applications. In a router device, this would be the typical red/black ports and rate limit packet filters, so that traffic doesn't impede each other, or provides a dynamic use equation for the real pipe. bought rate = rate allocated to clearnet apps + rate allocated to nextgen overlay app

1 0

ThunderSpy: Intel Fucks Up Closed Source HW Again
by grarpamp 12 May '20

12 May '20

https://thunderspy.io/assets/reports/breaking-thunderbolt-security-bjorn-ru… https://github.com/BjornRuytenberg/spycheck-linux Thunderspy targets devices with a Thunderbolt port... an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep. Thunderbolt devices possess DMA-enabled I/O. In an evil maid DMA attack Thunderbolt has been shown to be a viable entry point in stealing data from encrypted drives and reading and writing all of system memory. In response, Intel introduced Security Levels. We present Thunderspy, a series of attacks that break all primary security claims for Thunderbolt 1, 2, and 3. Inadequate firmware verification schemes Weak device authentication scheme Use of unauthenticated device metadata Downgrade attack using backwards compatibility Use of unauthenticated controller configurations SPI flash interface deficiencies No Thunderbolt security on Boot Camp These vulnerabilities lead to nine practical exploitation scenarios. Cloning user-authorized device identities to arbitrary attacker devices Permanently disabling Thunderbolt security and future firmware updates All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable. The Thunderspy vulnerabilities cannot be fixed in software Avoid leaving your system unattended while powered on, even when screenlocked. Disable the Thunderbolt controller entirely in UEFI (BIOS). Stay tuned for Thunderspy 2: Judgment Day. Intel has stated they had been already aware of Thunderspy variants... Intel has not shared why they have chosen not to inform the general public. The author of Thunderspy would like to thank prof. dr. Tanja Lange and Jacob Appelbaum for supervising his MSc thesis, of which this work is part, at Eindhoven University of Technology, the Netherlands. Oops!... ClosedHW did it again! https://www.youtube.com/watch?v=oIkRKc8wX24

1 0

[RUS] Who split Germany after WW2?
by Zenaan Harkness 11 May '20

11 May '20

Most us propagandized flunkies in the inglorious West don't actually know our history. For those who appreciate a quick catch up here and there, read it and empathize: http://russiafeed.com/divided-germany-cold-war-washington-moscow/ Who divided Germany during the Cold War – Washington or Moscow? The Soviet proposal for a neutral, united Germany was refused by the West, in order to create their own puppet state by Nikolay Starikov December 8, 2017, 12:17 pm

2 1