- cypherpunks - lists.cpunks.org

"How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries"
by staticsafe 24 Oct '13

24 Oct '13

https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/ -- staticsafe O< ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post. It is not logical. Please don't CC me! I'm subscribed to whatever list I just posted on.

1 0

Mail Lists In the Post-Snowden Era
by grarpamp 24 Oct '13

24 Oct '13

Regarding the subthread about examining sources... http://ask.slashdot.org/story/13/10/22/1416201/ask-slashdot-can-bruce-schne…

1 0

Legality of warrantless tech trolling
by grarpamp 24 Oct '13

24 Oct '13

And will these sorts of rulings be used to support cases brought to stop the recently disclosed spy programs... http://www.wired.com/threatlevel/2013/10/warrant-required-gps-trackers/

1 0

Re: Undernet IPv6 Interop [was: Enigmabox/cjdns]
by Eugen Leitl 24 Oct '13

24 Oct '13

Forwarded with permission. ----- Forwarded message from Caleb James DeLisle <cjd(a)hyperboria.ca> ----- I'm not really worried about what the IETF has to say, at some point I'll probably add an option to use IPv4 for cjdns too. When you do a DNS lookup for a site it will allocate an address for that machine out of whatever block you choose. Applications won't even have to support IPv6 to support cjdns. As far as address generation speed, the address is a double-sha-512 of your public key so it's extremely fast. Anything less than 128 bits (you're forced to collide the last 8 bits) would be dangerous. I'm sure we could have decided to limit valid keys to a fixed 16 bits or maybe even 24 but 48 bits would be quite unreasonable to expect of small devices. ----- End forwarded message -----

2 1

Re: [serval-project-dev] More on mesh addressing.
by Paul Gardner-Stephen 24 Oct '13

24 Oct '13

Hello, Jeremy I think has answered the broadcast issue, so I will focus more on the entropy issue. On Thu, Oct 24, 2013 at 3:48 PM, Miles <myles(a)tenhand.com> wrote: > > > On Wednesday, October 23, 2013 9:18:36 PM UTC-7, Paul Gardner-Stephen > wrote: >> >> Howdy, >> >>> >>> I think it is better that we harvest a nice lump of entropy from the >> radios rather than install random data (that might give naughty people help >> reproducing your private keys). We could read RSSI levels from the UHF >> radio, hash it a couple of times, and feed some bits into the entropy pool. >> This would just require talking to the radio a bit, which isn't too hard. >> > Using the radio as a HWRNG is interesting. Wouldn't RSSI be easily > predictable (and influenceable) by any observer with an SDR radio? At the > very least you'd need to tune the radio to an unknown channel, bandwidth & > hopping code first. Or use the difference between the two radios in a > clever way. User space clock solutions like havaged or DakaRand seem > easier. > I think clocks are good to use, also. For the radio RSSI, we could easily make an entropy gathering mode where the radio hops over quite a wide band, perhaps from about 870MHz ~ 1000MHz in a random pattern sampling ambient energy levels, i.e. without talking to a remote radio, just listening. Combine that with some clock input, and feeding the RSSI results into the forward channel selection to help further randomise the hopping sequence while sampling for RSSI, and we should be able to make a fairly robust entropy source. Thoughts? Paul. > > >> >>> >>>> I am not sure how easy it would be to detect the address conflicts when >>> they occur (regardless of address range and size). It would probably >>> require some careful thought and work to implement it >>> >>> >> I agree that it is ugly in many ways, short of getting a doctoral student >> to work on the problem for a few years. Even then, we still need a solution >> until then. Let's keep thinking about it for a few days and see if either >> of us can come up with a good solution. >> > IP collisions could be an unintended accident or a deliberate DOS. In the > case of DOS, doing nothing seems better than amplifying/feeding the energy > monster. > > Using the Mac -> IP conversion, we know that any accidental collision will > share our last 3 MAC bytes. But the odds are very good they won't share > bytes 2-3. > RARP/ARP/RARP would be awesome if it didn't fail for hidden/distant/lossy > nodes. > > Nodes with IP address conflicts can still send and receive broadcast > traffic. What is serval already broadcasting that we could use to look for > trouble unicasting? > Broadcast to nearest node's (serval?) echo service, unicast to them, if > the response doesn't come back, re-Ip? > > -- > You received this message because you are subscribed to the Google Groups > "Serval Project Developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to serval-project-developers+unsubscribe(a)googlegroups.com. > To post to this group, send email to > serval-project-developers(a)googlegroups.com. > Visit this group at > http://groups.google.com/group/serval-project-developers. > For more options, visit https://groups.google.com/groups/opt_out. > -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out.

1 0

Re: [Cryptography] [RNG] on RNGs, VM state, rollback, etc.
by Russ Nelson 24 Oct '13

24 Oct '13

Tony Naggs writes: > I think you a overestimating how much real entropy you will collect this > way [ through powerline drift.] Indeed. By the time you set up a powerline interface, you may as well just reverse-bias a diode, compare it to a low-pass-filtered version of itself, and capture that noise. You could do it with a DigiSpark, and get a USB bytestream. 100% open source, 100% auditable. http://digistump.com/ -- --my blog is at http://blog.russnelson.com Crynwr supports open source software 521 Pleasant Valley Rd. | +1 315-600-8815 Potsdam, NY 13676-3213 | Sheepdog _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 2

[Bitcoin-development] Core Development Update #5
by Melvin Carvalho 24 Oct '13

24 Oct '13

https://bitcoinfoundation.org/blog/?p=290 Very excited about this, particularly the 80 bytes embeddable message. I do believe satoshi mentioned he wanted to add short messages, at some point. Great work Gavin & all! ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development

1 0

Curious RNG stalemate [was: use of cpunks]
by grarpamp 24 Oct '13

24 Oct '13

On Thu, Oct 17, 2013 at 2:29 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > If we had good PRNGs everywhere, with lots of trustable physical entropy > stirred in then nobody would care about talking about these. > It would be boring, since a solved problem. > > Now show me a cryptographic quality PRNG with a few MBytes of > internal state. Best, a whole robust family of them. See? That's > some quality trolling, right there. Problem is, apparently no one is solving it, so round and round it goes... physical entropy, rdrand, reboot state, prng code. I'd guess that with good sources, today's prng code is sufficiently strong and at least some unix systems do save state across reboot. Now if someone would just sell a completely open discrete logic serial port hw entropy source for under $50... that would end a lot of the talk. Even with a more costly radiation source rather than other phenomena you'd still likely make good profit in quantity from China at that price. Sell other/cheaper/slower phenomena for a little less and make even more profit. Seal some up in a pretty wrapper and call it the corporate version for $1500.

14 19

Undernet IPv6 Interop [was: Enigmabox/cjdns]
by grarpamp 24 Oct '13

24 Oct '13

On Tue, Oct 22, 2013 at 4:51 AM, Eugen Leitl <eugen(a)leitl.org> wrote: > Just got word, Enigmabox has published source and > put up first documentation on http://wiki.enigmabox.net/ This is cjdns. Last I checked (and will again) I'm pretty sure they were using an IPv6 address scheme that would conflict with other projects using proper private space. So if say you wanted to run an interface for each project and run/access/route them all at once, you can't. Yes, less than 128bits (say a /48) is pretty weak... but when you can't interoperate [1] that leaves something to be said for each project to develop an address layer so you can. There certainly won't ever be more than 2^48 projects or 2^80 users. The undernets are getting bigger and having more projects. They might want to be thinking about interop beforehand. Otherwise, even though the tech under the hood might be different, to the user they will appear as bunch of balkanized communities, and a real pain to use any of them in parallel. [1] Click on a link to service on any net from a page on any net and let your host do the routing to get you there. Where any net = i2p/tor/freenet/phantom/cjdns/anonet/gnunet/etc. At least four of these do have some IPv6 route capability, but I thnk only a couple work together reasonably well.

2 2

[liberationtech] the virtual revolution in Second Life -- virtual model or just more RL?
by Shava Nerad 24 Oct '13

24 Oct '13

A virtual trip report with the strongest insider activist biases. Probably if anyone wants a paper out of this, I'm a subject, not an author. Perhaps a small thing in the larger world, where Tor has been in the headlines for Silk Road and amusing powerpoint presentations by the NSA this week, eh? But in the world of tiny virtual first-world-problems, I am also an art performance celebrity/Buckaroo Banzai type in virtual space. tldr links: http://quora.com/What-are-some-brain-hacks-that-neuroscientists-psychologis… http://www.youtube.com/watch?v=3ukKCWRJudM (getting our act slotted on NBC's America's Got Talent) http://www.businessweek.com/stories/2008-02-14/so-i-married-an-avatarbusine… http://npirl.blogspot.com/2008/02/tunas-trippy-textures.html http://www.youtube.com/watch?v=IiAG06k9m7o (one of a series of stealth edu machinima produced for German TV) http:oddfellowstudios.com We have a following of some reasonable thousands on SL, even though we've been in slack mode for a couple years, since this is, needless to say, not a money maker. But it is community. The Second Life community is notable for its to-me loveable and often neurotic population of fannish, high percentage (I'm not) transhumanist digital natives who make "digital native" an absolute in a way unheard of in most gaming or social media contexts. As such, this community is an interesting vanguard for social, legal, and other bubbling up phenomena before they hit more sociotypical online society. With a higher percentage of ASD, disabled, homebound, socially isolated folks, as well as a higher percentage of cultural creatives, intellectuals, educators, DIY/makerspace each-one-teach-one types, medical outreach groups, activists, self-help group facilitators and coaches, human rights advocates, (para)military trainers, wisdom teachers, and other engaged intellectuals (often meshing in Venn diagrams) -- whose silos sometimes interact or not with a vast majority of consumers who are just there to party and buy cool clothes, dance, and hook up -- it's a weird weird weird weird virtual world. When it came to light recently that Linden Lab, operator of Second Life, had made some incredibly draconic changes to their TOS, the community freaked. And LL went to New World Notes (the primary metagame media) and smoothed things out with PR, for the most part. Then I saw the TOS more recently through an individual blog article in the arts community (as I said, we're a bit behind and in slack mode) and freaked, myself, and posted here a couple weeks ago. As a result, in the intervening time, there's been a turnaround in community opinion the issue. We catalyzed a great deal of that. Oddfellow Studios (that being me and Fish Fishman, aka Shava Suntzu and Tuna Oddfellow in virtual space) pulled our stuff and moved to Inworldz, an open source grid (imagine a miniature version of Second Life with a thousands rather than millions of users -- a public private server, so to speak, still with a real-money economy, and with the same asset server type so you can import your own assets -- and violating license could conceivably rip other peoples' (c) but we don't, or could import certain FOSS licensed assets which we have). We were back up and running a rough equivalent to our show within a week, including our monthly collaboration with JaNa KyOmOoN (AKA Jan Pulsford, keyboardist to Cyndi Lauper) with whom we do two monthly dates cross continent, us in New England, her in England. Because we are art performance folks and our fans tend to early adopters even for SL, I think a lot of our fans weren't hesitant to "jump grids" and become metaversals -- this is to say, they just registered with Inworlds, created a new avatar, loaded up the very similar client, and came to enjoy the show. The shows in SL got press coverage too, showing how easy it was to move, and how people moved with us as our fan base. Through all this, I worked the metagame press, as well as blogging and discussing the issues in and out of game, as did Tuna. Language and backgrounders we crafted began to propagate, and went unopposed by any official pushback by the Lab, New World Notes did a dramatic turnaround on their position when I pointed out that a perpetual irrevocable license (including rights to reassign/sell/resell) means that if, say, the Lab goes tits up, all assets go into receivership and anything in the SL asset server is up for auction if it isn't marked by copyright -- hunting down your assets to defend them is up to the owner in that case (IANAL but I did used to work in entertainment licensing). By the time you straighten things out tracking and defending your copyrights, as I pointed out, your legal help better be free. NWN went to the Lab for comment a couple weeks ago. Got none presumably. I think Hamlet/NWN felt somewhat played by the previous PR response he'd gotten. He's solidly on the dissent side of the question now, perhaps feeling like he was likely responsible for people making bad decisions in the first round, although I haven't directly asked him that -- seems like bad form. Though the Lab hasn't officially responded, an interesting, quite erudite comment that opened "Well, I'm not a creator in SL and I don't have a horse in this race but..." on New World Notes signed "imho" supported the Lab's position with expert legal language -- conflating several points masterfully. I refuted it, and postulated "This might not be a very humble opinion, but might even be Humble's [the Linden Lab current CEO's] opinion." "imho?" lol. While I've been ill, one of my sidelines for income has been working as a ghost writer because I have a great ear for different writers' cadence and style. 'nuff said... Now the "bug" is spreading from the arts community to educators and many other communities that have been long time conservative land holder blocs (this is to say, income producers and also PR anchors that are not pr0n) in SL. Intellectual foment is taking over, as is often the case in RL governmental stonewalls of this sort. Movement momentum is reaching, if it hasn't reached, a tipping point, and the brain drain is likely unstoppable. Several major vendors of intellectual property (textures, art assets) have pulled their relationship with SL, stopped selling and forbidden creation of new assets with their assets in SL. Creators are leaving SL in droves for alternate open source grids. The mothership is emptying out, at least experiencing a brain drain of a vibrant population that characterized it's first generation, the generation that made it "Second Life," the dream of its own mad (social) scientist creator, founding CEO Philip Rosedale. Every week that LL withholds action and further comment, they are heading further toward a future more like There.com (an authoritarian barbie-and-ken-and-einstein-on-the-beach dead virtual world that was entirely company authored content) and less like the Burning Man inspired "Your World, Your Imagination" user-created economy envisioned a decade ago. So my assumptions are: They have to know what's going on. They aren't STOOPID. They are either constrained in action. Or they want us out. Or they find the cost acceptable. Or some amalgam thereof. It seems to me that the company is too small for them to be slow to act, which is another possibility in a very large company or bureaucracy. But I'll include that as a gridlock staff/board conflict, say, as a low possibility. Never underestimate the paralysis potentiality of politics. Look at DC. Another interesting aspect becomes the influence of the government crackdown on the Linden Dollar as a "bitcoin" like currency exchange. Several Linden Lab independent linden dollar currency exchanges were shut down in dramatic style earlier this year with the loving interference of the US government, and only two were reopened after undisclosed negotiations having to do with PII, it seems (although more have opened since) -- so this does have some legit overlap with interests on this list...heh... I've even entertained for a fleeting moment that they have some sort of weird NSL thing going on...NAH... C'mon Shava... Not every uncommunicative stonewall from an internet company you like has an NSL behind it... These are just odd times. http://slnewser.blogspot.com/2013/05/most-third-party-linden-exchange.html But interference in the exchanges could also lead to FUD within the investors, a new strength to the internal political clout of the legal department, and many other destabilizing issues (the PR department explanation for the new TOS is that Legal wants "a unified TOS across all the Linden Lab businesses," which include game companies with no user created content. My refutation to this was that if they were running a truck fleet and an airline fleet for shipping businesses, their legal department would be fools to use the same liability and shipping guarantees for both companies. What are other pressures on a company like LL, their board/investors, and the future of Internet culture that leads to moves like this these days? What will it mean to the diaspora of creators to move into a cloud of small grids and how will that be a model for systems like Diaspora and more traditional forms of social networking? Seems to me this is a mesh of issues that bears watching for some folks here. I understand Second Life has been so "over" for at least a half dozen years, but we've been ahead of the game(s) (and distinctly off center) for at least a decade, so we make up for it. ;) yrs, -- Shava Nerad shava23(a)gmail.com -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

5 4