- cypherpunks - lists.cpunks.org

Testing whether devices are NordVPN proxies
by Mirimir 04 Dec '19

04 Dec '19

It seems that NordVPN is routing traffic to Disney+ through many residential IPv4 in the US.[0,1] As much as I love VPN services, it would suck if people's devices are unwittingly serving as NordVPN exits. Even if it's just for something as innocuous as Disney+. And it's easy to test that yourself, if you have a NordVPN account. If you're hitting a site using the Akamai CDN via one of NordVPN's US servers, you can see the server's exit IP address: $ curl -LIX GET https://foo.bar -H 'Pragma: akamai-x-get-client-ip' Generally, the "X-Akamai-Pragma-Client-IP" is the same as the server's nominal exit IP address: $ w3m -dump https://ipchicken.com But when hitting https://www.disneyplus.com it's not. But rather, it's some IPv4 from a residential ASN. Which you can check using https://ipinfo.io or whatever. I've seen no definitive information about the nature of these residential proxies. They might be NordVPN customers in the US, although that seems too footgun. Or they might have installed some third-party app with a bundled proxy server. Or it could even be outright malware. But in any case, it'd be cool if people could determine whether their devices are being used as NordVPN exits. I've run about 300 tests so far, on a few NordVPN's US servers, and found about 270 distinct proxy addresses. And so I've hacked a simple Linux test script, using hashed "X-Akamai-Pragma-Client-IP" values.[2] Just save the code block at the top as "test.sh" or whatever. Then do "chmod u+x", and execute in the terminal. It'll prompt "IPv4 to search for?". Type an IPv4, and hit "Enter". This is howling in the void, I know. But so it goes. 0) https://www.wilderssecurity.com/thr...it-might-be-through-your-own-computer… 1) https://news.ycombinator.com/item?id=21664692 2) https://pastebin.com/YYc9Kuax

3 4

Richard Spencer is like a little baby
by Ryan Carboni 04 Dec '19

04 Dec '19

https://twitter.com/LokiJulianus/status/1202030931168632832 The networks that Richard Spencer belongs to make decisions after an orgy. He has no idea how to handle a situation where someone laughs at the idea of a guy raping his countrymen. Certainly Spencer should have glared at minimum. I've attached a salient picture.

1 0

Re: [2600-AU] Apple cannot be trusted - violation of Australian federal Data Protection/Electronic Crime Law
by Zenaan Harkness 04 Dec '19

04 Dec '19

On Wed, Dec 04, 2019 at 07:05:47PM +1100, Sid E wrote: > All the affidavits were dismissed, not just some, ALL, including 2 > witnesses there at the time, and the person putting the case against me. I would like to know why they were dismissed - sometimes there's some technicality, such as the other side failing to provide their affidavits within allowed time frames, or some other technicality; but "affidavits are not allowed in the Magistrates Court" is simply not true, that's why I was hoping you might remember, or be able to look up, how you got the other side's affidavits removed - could be useful to me (and others) in the future :) > If I represented myself it would have been much more difficult to win even > though ultimately i was innocent. > > I spent hours and hours building a case with CCTV footage, sms screenshots > and information about phone calls, a detailed log of events for almost a > year... > > And like you suggested I put it all together in a nicely orderly fashion to > make it easy to present to a magistrate, save the lawyers time and save big > $, unless you get paid like $400 an hour then just dump a pile of paperwork > on them... Well done, sounds like your work paid off - in more ways than one. > I'm wasnt trying to say you're completely wrong at all with your advice - I Since IANAL, I can give no "legal advice", only my opinions =) > was just pointing out affidavits can't be used in the magistrates court, > which is actually not that significant if you have witnesses on hand - so > if OP (i know where you live) decides to go to court he's aware and ready > with proper evidence, or particulars as they like to call it. > > Also I don't really know where OP lives but I reckon I could backtrace it If it was "relatively recent", it might be an interesting adventure for them to drag Apple's butt into small claims :) For the $37 filing fee and a few hours of preparation, you can't go too far wrong on this one :) Although personally, I'd at least consult a lawyer about "reasonable" exemplary damages given the circumstances, and a useful precedent or 10 related to such claims, and then file in the appropriate court for the size of the claim. And remember to enjoy the journey,

1 0

Re: [2600-AU] Apple cannot be trusted - violation of Australian federal Data Protection/Electronic Crime Law
by Zenaan Harkness 04 Dec '19

04 Dec '19

Ah yes, I would agree that if you have an affidavit, and you do NOT have the witness there to be cross examined on their affidavit, THEN the affidavit will get thrown out at the hearing. The solution to this is simple - ensure your witness (or you, if it is your affidavit) actually turn up to the hearing of your own court case. That is an important fact about witnesses, and the same deal applies in the higher courts - if your witness does not turn up, an affidavit will not help, since the other side cannot cross examine the witness about their affidavit, and so the affidavit gets thrown out... That's a specific circumstance you should be prepared for. Of course, if it is your own case, and your own affidavit, presumably you are going to turn up to the hearing, and so the affidavit in this case cannot be thrown out - but your opponent can of course ask to cross examine you, and then you get into the witness stand and they cross examine you. If you are not confident in the facts of your own case, or if you are not confident generally, and you can afford a barrister, it is almost certain you'll get a better outcome by paying for a barrister and lawyer. But that costs a lot of money. On Wed, Dec 04, 2019 at 05:13:31PM +1100, Sid E wrote: > Just because an affidavit can be used in an application doesn't mean it can > be used within a hearing. > > You can't question an affidavit, thus it allows a "witness" to deliberately > leave things out and not give the other party a chance to either disprove > it or add more to it during questioning > > Therefore an affidavit can't be used as evidence whilst a case is actually > being heard, the witness or party has to physically be there (or via > video). > > --

1 0

Android Ups the Mobile Security Ante with Default TLS Encryption
by jim bell 04 Dec '19

04 Dec '19

https://threatpost.com/android-mobile-security-tls-encryption/150760/ More than 90 percent of Android apps running on the latest OS encrypt their traffic by default. A full 80 percent of Android apps are encrypting their traffic by default, according to a Transport Layer Security (TLS) adoption update from Google. That percentage is even greater for apps targeting Android 9 and higher, with 90 percent of those encrypting traffic by default, the tech giant said on Tuesday. TLS is a cryptographic protocol standard ratified by the Internet Engineering Task Force that provides end-to-end communications security over networks by scrambling data in transit, preventing hackers from reading it, intercepting it or tampering with it. TLS can be enabled for any internet communication or online transaction, such as a connection between a mobile shopping website and a user’s mobile browser, or between a banking app and the bank’s backend servers. The security of those connections is then verified via secure TLS certificates. As of October 2019, a third (33 percent) of Android devices run Android 9 (Pie), the latest version of the operating system. That makes it the most popular Android version. According to Google, apps targeting Android 9 or higher automatically have a policy set by default that prevents unencrypted traffic for every domain; and, since November 1, all apps on Google Play must target at least Android 9. [end of long quote]

1 0

What a bunch of spineless idiots at Twitter
by Ryan Carboni 04 Dec '19

04 Dec '19

https://twitter.com/en/tos >If you are a federal, state, or local government entity in the United States using the >Services in your official capacity and legally unable to accept the controlling law, >jurisdiction or venue clauses above, then those clauses do not apply to you. For such >U.S. federal government entities, these Terms and any action related thereto will be >governed by the laws of the United States of America (without reference to conflict of >laws) and, in the absence of federal law and to the extent permitted under federal law, >the laws of the State of California (excluding choice of law). I've never read such vacillating nonsense in my life. It can't be a legally binding agreement if within the agreement if it says it is up to Twitter to interpret laws. As I'm not a lawyer, I think I will end up blocking twitter's domains sometime this month, as I certainly do not agree to the terms, find it unequal, and am beginning to believe only the exposure of wrongdoing and systemic collapse is the only viable option at this point.

1 0

Re: [2600-AU] Apple cannot be trusted - violation of Australian federal Data Protection/Electronic Crime Law
by Zenaan Harkness 04 Dec '19

04 Dec '19

Thank you for those pointers. Yes, VCAT/NCAT etc often have a "state clearly and briefly what happened" section on their "application forms", usually also with a suggestion to "attach an additional sheet if you can't fit it in this box" type of thing. My personal (IANAL) preference is to present my own matters, even in the higher courts (I am in the Vic Supreme Court at the moment on the "right to be heard in my own defence, when I am caused to appear in court" basic human right). As to your assertion that "An affidavit can't be used in a Magistrates Court" - this is simply not true, and is IMEHO, an egregious suggestion to those who might choose to self represent. Many times I have filed affidavits into the Magistrates' Courts of both Victoria and New South Wales, and on one occasion only (when I believed it was in my interest to do so) did I file a Statement (self signed, not even a statutory declaration). Further, I have spoken personally with/ seen, acquaintances who began with a court case in the Magistrates' Court, and proceed on some sort of appeal into the Supreme Court, have to re-do their statement or stat dec, and file it as an affidavit (the only form the Supreme Court accepts). I was even supporting a self represented VCAT defendant, who actually filed an affidavit to lay out his version of events - VCAT accepted that affidavit, and he relied on it during the hearing. So if you have some authority to back up -why- it is that you say "An affidavit can't be used in a Magistrates Court", then I would very much appreciate a link or copy of the document, so that I can read that authority (law, regulation, section or other document) which you are referring to. Especially given that you say you "work for the cyber police", any insight into such laws or regulations would likely be useful for humble folks such as myself - so thank you in advance. On Wed, Dec 04, 2019 at 02:42:57PM +1100, Sid E wrote: > An affidavit can't be used in a Magistrates Court, and I don't believe they > hold much weight under a Tribunal (VCAT for example), if you are > representing yourself, and VCAT doesn't allow you to be represented by a > legal professional automatically, you have to apply to be allowed to. > > There is some exceptions to this and considering its Apple they will be > sending a full team of overpaid legal thugs to quickly stomp out anyone who > dare slander the cult of scientology *cough* sorry Apple. > > The rest of your legal advice seems pretty solid though, collect evidence > and data. > > Trust me, I work for the cyber police > > -- > -- > ------------------------------------------------------------ > You received this message because you are subscribed to the "2600 Australia" group. > To post, send email to: 2600-australia(a)googlegroups.com > To subscribe, send email to: 2600-australia+subscribe(a)googlegroups.com > For 2600 monthly meetings, visit http://www.2600.org.au > For more options, visit this group at http://groups.google.com/group/2600-australia > To unsubscribe, send email to: 2600-australia+unsubscribe(a)googlegroups.com > Disclaimer: Comments to this mailing list are owned by the poster > ------------------------------------------------------------ > > --- > You received this message because you are subscribed to the Google Groups "2600 Australia" group. > To unsubscribe from this group and stop receiving emails from it, send an email to 2600-australia+unsubscribe(a)googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/2600-australia/CAMP2cBKB_A%2Bi%2BA%3DrXyx….

1 0

Libgen Sci-Hub: Got any terabytes?
by grarpamp 04 Dec '19

04 Dec '19

> https://old.reddit.com/r/seedboxes/comments/e129yi/charitable_seeding_for_n… > https://old.reddit.com/r/libgen/ > https://old.reddit.com/r/scihub/ > https://the-eye.eu/ > https://www.vice.com/en_us/article/pa7jxb/archivists-are-trying-to-make-sur… > https://torrentfreak.com/sci-hub-libgen-blocked-by-austrian-isps-following-… https://news.ycombinator.com/item?id=21692222 https://old.reddit.com/r/datahoarder/ https://old.reddit.com/r/DataHoarder/comments/e0sb8b/theeyeeu_we_now_host_t… Lots of data archive and distribution tools mentioned in above threads. New AMD systems, entire lineup, now flying off the shelves... https://wccftech.com/amd-ryzen-9-3950x-entire-inventory-outsold-japan-world… https://news.ycombinator.com/item?id=21679470 https://old.reddit.com/r/amd/

1 0

Co-op Guerrilla Meshnets
by grarpamp 04 Dec '19

04 Dec '19

https://www.newyorker.com/tech/annals-of-technology/the-one-traffic-light-t… Not an example of distributed DIY co-op, but a story anyway... McKee, an Appalachian town of about twelve hundred tucked into the Pigeon Roost Creek valley, is the seat of Jackson County, one of the poorest counties in the country. There’s a sit-down restaurant, Opal’s, that serves the weekday breakfast-and-lunch crowd, one traffic light, a library, a few health clinics, eight churches, a Dairy Queen, a pair of dollar stores, and some of the fastest Internet in the United States. Subscribers to Peoples Rural Telephone Cooperative (P.R.T.C.), which covers all of Jackson County and the adjacent Owsley County, can get speeds of up to one gigabit per second, and the coöperative is planning to upgrade the system to ten gigabits. (By contrast, where I live, in the mountains above Lake Champlain, we are lucky to get three megabytes.) For nearly fifteen million Americans living in sparsely populated communities, there is no broadband Internet service at all. Fibre-optic cables strung above a home in Jackson County, Kentucky, one of the poorest counties in the country. High-speed broadband has been used to bring Internet-based jobs to the region. Before Shani Hays began providing tech support for Apple from her home, in McKee, Kentucky, she worked at a prison as a corrections officer assigned to male sex offenders, making nine dollars an hour. After less than a year, she switched to working nights on an assembly line at a car-parts factory, where she felt safer. More recently, Hays, who is fifty-four, was an aide at a nursing home, putting in a full workweek in a single weekend and driving eighty-five miles to get there. Then her son-in-law, who was married to Hays’s oldest daughter, got addicted to crystal meth and became physically abusive. Hays’s daughter started using, too. The son-in-law went to jail. Their kids were placed in foster care. Then Hays’s stepmother got cancer. “There was a lot going on,” Hays told me. “I was just trying to keep it all together.” She began working from home last summer, which has allowed her to gain custody of her three grandchildren. (Her daughter has since completed treatment for her addiction.) During Hays’s half-hour lunch break, she makes supper. “I wouldn’t be able to do this without the Internet we have here,” she said.

2 1

Facialized: US will Follow UN CN by Adopting Facials for SIM Cards and Internet
by grarpamp 04 Dec '19

04 Dec '19

https://www.technologyreview.com/f/614781/all-new-cellphone-users-in-china-… https://www.ft.com/content/c3555a3c-0d3e-11ea-b2d6-9bf4d1957a67 Your demands, coming to you since 1984... A report from MIT Technology Review: Customers in China who buy SIM cards or register new mobile-phone services must have their faces scanned under a new law that came into effect yesterday. China's government says the new rule, which was passed into law back in September, will "protect the legitimate rights and interest of citizens in cyberspace." It can be seen as part of an ongoing push by China's government to make sure that people use services on the internet under their real names, thus helping to reduce fraud and boost cybersecurity. On the other hand, it also looks like part of a drive to make sure every member of the population can be surveilled. The Financial Times reported yesterday that tech companies in China are helping to create influential United Nations standards for the facial recognition technology, which will help shape rules on how facial recognition is used around the world.

1 0