- cypherpunks - lists.cpunks.org

[WAR] US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world”
by Zenaan Harkness 04 Sep '16

04 Sep '16

** Must see video: US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world” (http://theduran.com/must-see-video-us-peace-council-returns-syria-county-fi…) ------------------------------------------------------------ must-see-video-us-peace-council The campaign to confuse the American people has been intense, but one thing is sure, Syria is fighting an invasion, not a civil war. The post Must see video: US Peace Council returns from Syria, a country fighting “invasion by the most powerful country in the world” (http://theduran.com/must-see-video-us-peace-council-returns-syria-county-fi…) appeared first on The Duran (http://theduran.com) .

1 0

4096 bit SSL keys
by John 04 Sep '16

04 Sep '16

Speaking within the context of https SSL certs, is there any real value to a key/cert above 2048 bits? The reason I asked: updating a few certs at office recently I nuked an older F5 LTM device by installing a 4096 bit key/cert pair - the load on the appliance (Linux based) shot up from less than 1 to about 30 and became so excruciatingly slow it was nearly impossible to back the change out (web GUI and ssh were both nearly non-responsive).. On modern hardware, including modern F5s, this problem doesn't exist... but from what reading I've done it seems 4096 buys you very little anyway ? With a theoretical quantum computer attacking is there any significant gain with the bigger key size? Curious what others think.... John -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

4 3

The Unsettling Relationship Between Russia and Wikileaks
by grarpamp 04 Sep '16

04 Sep '16

http://www.nytimes.com/2016/09/01/world/europe/wikileaks-julian-assange-rus… http://www.dailymail.co.uk/news/article-3769958/Does-Wikileaks-help-Russia-… Now, Mr. Assange and WikiLeaks are back in the spotlight, roiling the geopolitical landscape with new disclosures and a promise of more to come.

3 2

Playing with overlay networks
by Mirimir 04 Sep '16

04 Sep '16

So let's say that a bunch of us have Tor onion servers. They're linked to each other via OnionCat with ip4ip6 tunnels. With IPv4 routing so each can hit the others. And with iptables rules (IPv4 and IPv6) to drop packets to/from everyone else running OnionCat. Maybe even HiddenServiceAuthorizeClient/HidServAuth to lock down access. What might we do with that? We might create an overlay Internet, I suppose. Given how long OnionCat has been around, there are probably a few of those. I doubt that OnionScan[0,1] would see the connections, given that there are no hyperlinks, and better, no unauthorized access. But more specifically, what? BitTorrent, for sure ;) LizardFS works, so we could have private and shared cloud storage, backed by globally redundant, erasure-coded storage. What about VPN services? Say, with two VPS linked via OnionCat. You hit VPN server as an onion service, and exit through one of many redundant VPS. We already have <https://i2vpn.eu/>. So maybe chain that with VPNs via onion services. What do y'all think? And what about Freenet or I2P on an OnionCat network? Or one of the P2P messaging apps? Or even old-school Mixmaster? Back to basics, would any of that help against global adversaries? It's very hard to evade observation of network edges. You can have lots of chaff, but then that itself can be a signature. [0] https://github.com/s-rah/onionscan [1] https://motherboard.vice.com/read/these-maps-show-what-the-dark-web-looks-l…

2 2

Fwd: Re: [Cryptography] "Flip Feng Shui: Hammering a Needle in the Software Stack"
by Georgi Guninski 04 Sep '16

04 Sep '16

----- Forwarded message from Georgi Guninski <guninski(a)guninski.com> ----- Date: Sat, 3 Sep 2016 08:49:34 +0300 From: Georgi Guninski <guninski(a)guninski.com> To: Jerry Leichter <leichter(a)lrw.com> Cc: Florian Weimer <fw(a)deneb.enyo.de>, Cryptography List <cryptography(a)metzdowd.com> Subject: Re: [Cryptography] "Flip Feng Shui: Hammering a Needle in the Software Stack" On Fri, Sep 02, 2016 at 10:56:10AM -0400, Jerry Leichter wrote: > > Why bother with patching public keys, making them amenable to > > factorization, if you can patch executable code instead? > > > > If you can target executable code (and I see why not, it's all the > > same to KSM), it is very clear that there cannot be a software-only > > defense.... > The technique cannot be aimed exactly: You can flip some unpredictable, uncontrollable subset of the bits in a word. (The vulnerability of particular bits is dependent on physical variations in the memory cells.) > ... > Attacks against the executable code are certainly the worst case, and you might be able to find security-sensitive but very rarely executed code to attack. But this is likely much harder to pull off than the attack outlined here. > Flipping random bits in a word at chosen location is very powerful primitive. I am taking bets that it is moderately easy to exploit via many vectors. Flipping random bits of zero word make it nonzero. In a boolean context, this flips False and True, screwing the logic. eg in: if(is_root || is_authorized) give_em_power(); else drop_em(); ----- End forwarded message -----

2 2

PC-BSD Follows a Rolling Release Model, Gets Renamed To TrueOS
by grarpamp 04 Sep '16

04 Sep '16

http://linux.softpedia.com/blog/pc-bsd-operating-system-gets-renamed-to-tru… https://www.trueos.org/2016/09/01/pc-bsd-evolves-into-trueos/ We are proud to announce that the PC-BSD project has evolved into TrueOS: a modern, cutting-edge distribution of FreeBSD focused on security, simplicity, and stability for desktops, servers, and beyond! TrueOS harnesses the best elements of PC-BSD, combines it with security technologies from OpenBSD, and layers it on top of FreeBSD to provide a complete system for modern machines. TrueOS combines the convenience of a rolling release distribution with the failsafe technology of boot environments, resulting in a system that is both current and reliable. TrueOS now tracks FreeBSD’s “Current” branch and merges features from select FreeBSD developer branches to enhance support for newer hardware and technologies. Weekly automatic updates keep your system always up-to-date, and all updates are performed safely within system snapshots called boot environments. The TrueOS desktop uses the modular yet feature-rich Lumina desktop environment alongside the new SysAdm administration suite to provide a reliable desktop experience. SysAdm provides local and remote management of TrueOS and FreeBSD systems using a cross-platform graphical client compatible with Windows, Mac, and many Linux distributions. TrueOS is preconfigured for desktop and server installations using an intuitive graphical installer, taking the guesswork out of setting up a new system. Beta-quality images of TrueOS are currently available on trueos.org for users to help test in preparation for the upcoming release. These images demonstrate the rolling-release model and will seamlessly transition into the release version of TrueOS. As always, we thank you for your feedback and for being dedicated members of our community. TrueOS Features: Now a rolling release based on FreeBSD-CURRENT. Weekly package/ISO updates (or more often, as necessary). Only one package repository. Update when you’re ready and never get left behind again. Automatic updates can be enabled/disabled as desired. All updates are performed in a safe manner using Boot Environments. Updates never change your live system, as the updated system is not activated or used until you reboot Existing PC-BSD/FreeBSD users can use the non-destructive fresh installation into a new boot environment on non-encrypted ZFS pools. This mechanism preserves all user data while performing a fresh install of the operating system and all applications. Simply re-create any user accounts post-installation to access the data in their home directories TrueOS Desktop pre-installs a pure Qt5 system based around the Lumina desktop and SysAdm. TrueOS Server pre-installs the SysAdm service for remote system management, with remote access initially disabled. A full repository of applications is available for installation through AppCafe. TrueOS is currently in Beta status. All of the critical functionality is complete, but we are still migrating some utilities from PC-BSD to the new TrueOS framework. Differences from FreeBSD 11.0: LibreSSL has replaced OpenSSL completely, even in the FreeBSD base. Linux DRM 4.7 compatibility adds support for the Haswell, Broadwell, and Skylake Intel graphics. The entire system, including the FreeBSD base, is managed by pkg.

2 1

Police Seize Perfect Privacy VPN Servers
by grarpamp 04 Sep '16

04 Sep '16

https://torrentfreak.com/police-seize-two-perfect-privacy-vpn-servers-16090… VPN provider Perfect Privacy has had two of its servers seized by Dutch police, as part of an active investigation. Police bypassed the VPN service and went directly to the company's hosting provider, I3D, who complied with a subpoena requesting the hardware. At the time of writing, it remains unclear why the servers in question were taken.

2 1

Re: individual responsibility - was Re: Nationalism vs Globalism
by Mirimir 04 Sep '16

04 Sep '16

On 09/03/2016 04:03 AM, Zenaan Harkness wrote: >>> Is it possibly less than 'constructive' to dishearten individuals before >>> they've even begun? >> >> So maybe do something, instead of talking so much about it. > > Specific action has been underway for a few years, expecting about 2 to > go. Will report here when success of course. > >>> Could doing so, in the context of "fly below the radar with compliance >>> with the state" be seen as, I dunno, statist propaganda perhaps? >> >> Are you fucking serious? > > Yes. > > "do not oppose the state publicly" is easy to read as "comply with the > state". What I mean is don't get caught opposing the state. Where you have an oppressed majority that acknowledges its oppression, nonviolent resistance is a viable option. India. US south. South Africa. But it's hard so see how that would work in Australia, for example. But hey, if going down as a martyr is your trip, go for it! > This is hard to read in an anarchist context as anything other than > directly counter to the foundation principles of anarchism. I don't care much about labels. There is no "anarchism". > Do you say there's some flaw in this reasoning? Yeah, I did :)

4 4

FOR once and FOR ALL
by Xer0Dynamite 04 Sep '16

04 Sep '16

Let's get this straight so all you can shut up or put up: There are two futures: one of an Apocalypse or one of Enlightenment. There are four prophesies (two religious and two mystical/new age) and two purely rational arguments why a dramatic and planetary shift MUST and WILL happen in one form or another. All this in-fighting is worthless. If you want the good future it will take Truths that you do not yet have or Righteousness for those who have NO voice in the world. These groups are right in America, no need to think they're far off and inaccessible. The experts have been wrong -- all of them. Whether it's medical doctors (who have never made a sane nor healthy world) or scientists (who have not secured a safer future and have wrapped themselves in a elaborate narrative exactly reminiscent of the Allegory of Plato's Cave) or religion (who have never even been held to their own creeds like protecting Earth and Do Not Kill), the failure also lies on all the MASSES (you and me) who have allowed this clusterfuck to happen and continue everyday. You are using your smartphone and sipping coffee to browse the web and be cool, right? All these petty issues like bitcoin and encryption, or occupy and gay rights are so far down the spectrum as to be laughable. The value of cypherpunks is tools for greater activism or personal development, not hiding from the State like little peons, but TRANSCENDING it. Read Hack the Law at hackerspaces wiki or New World Order, also at that site. Either the future is made BY us, or it is destroyed by US. Which is it? \0xDynamite

5 6

Re: Continual Violation of List Charter
by Cari Machet 03 Sep '16

03 Sep '16

Why are you fucks trying to kill a listserv ? ... because you are fascists the topic of fascism is brought to the list by you enacting fascist tendencies ... should we ban the topic of fascism ? lets ban you and any admin because that is fascist ... if you dont want to be wholly part of the list you can set your little gadget to edit out the sad parts for you ... or dont you little fascist pussies know how to use technology ? On Sep 4, 2016 5:35 AM, "juan" <juan.g71(a)gmail.com> wrote: On Sat, 3 Sep 2016 14:14:13 -0700 "Stephen D. Williams" <sdw(a)lig.net> wrote: > On 9/3/16 1:30 PM, juan wrote: > > On Sat, 3 Sep 2016 14:41:52 -0400 > > grarpamp <grarpamp(a)gmail.com> wrote: > > > > > >> [1] > >> "The Cypherpunks mailing list is a mailing list for discussing > >> cryptography and its effect on society." > > incomplete, and you didn't even provide a 'source' > > > > plus, it's obvious that you haven't read the 1992 - ~1998 > > archives of the list. > > Archives? We read it in real time. Who - the fuck - is we. My message was addressed to grarpamp. I bet he didn't read it in real time. > > If it isn't directly about the access to or effects of cryptography > and related security practices, it is off topic. Because an absurdist like you says so. > > Early on, the list was largely about making sure that we had > unfettered access to encryption and reasoning about the consequences > of that. This was important for ecommerce, the Internet in general, > the boundaries of the First Amendment, and as the baseline for the > rest of the world. All kinds of power grabs were in play, directly > from the FBI and others. A weak response might have left us in a > position difficult to unravel. Most of that came out OK, Exactly what a US establishment puppet woud say. So let's see : 1992 : "Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. " I wonder if Tim May is embarrased at having mande such a blatantly wrong predicion. " Interactions over networks will be untraceable, via extensive re- routing of encrypted packets and tamper-proof boxes which implement cryptographic protocols with nearly perfect assurance against any tampering." Where are such networks operating? What we do have is completely sabotaged hardware courtesy of Intel Inc, a criminal organization that May had something to do, I believe. > but there > are always ongoing concerns and implications. Oh... > > Arguing whether the end of the world is coming or whose fault it is > or who is making political or military mistakes is all completely off > topic. Sure. It's especially important that the political 'mistakes' of the american nazis be completely 'ignored'. > > sdw >

2 1