- cypherpunks - lists.cpunks.org

Austria to make Right To Pay In Cash
by grarpamp 14 Feb '16

14 Feb '16

http://yro.slashdot.org/story/16/02/12/1547203/austrian-minister-calls-for-… Extend to BTC.

1 0

The Iran-Contra White House Emails
by Michael Best 14 Feb '16

14 Feb '16

Since it's coming up in some of my historical research, and definitely relevant with all of the HRC email stuff in the news right now, I thought I'd check and see if anyone here happens to know what agency has custody of the 3,000 White House emails that were released to the NSArchive after their lawsuit. About 250 were published by NSArchive, but the rest haven't been made available yet. If anyone happens to know what agency has them, let me know. I'd love to get my hands on them. My initial check with NARA shows only the million restricted emails held by the GHWBush Presidential Library, but I'll check with the archivists at NARA II next week. Let me know if you have any leads! -Mike

1 0

Small codebase as a prerequisite for security
by Sean Lynch 13 Feb '16

13 Feb '16

I laughed out loud when I read on the Invisible Things Labs' Blog that Xen is "only" a "few hundreds of thousands of lines of code."[1] Sure, this is small compared to most modern monolithic desktop OSes, but it's not particularly small compared to a stripped down Linux kernel build, and it's absolutely gigantic compared to a modern microkernel. The Nova Microhypervisor and seL4 are each about 9000 SLOC. But when I shared this disbelief with a couple of friends who at least have a passing understanding of computer security, each of them just shrugged. And of course both Nova and seL4 have had a lot of trouble gaining any kind of foothold in the market. Am I completely off base in thinking that it should be self-evident that one should start building any secure system by minimizing the size of their trusted computing base? Or is the issue that applications are still the source of most vulnerabilities, so it's premature to try to make the kernel super secure? Or that there are too many ways to violate isolation in a microkernel by compromising shared server processes? I ask because I am wondering if I should "learn to stop worrying and love the bomb" and (re-)embrace Xen and/or Linux, or if I should continue pursuing some approach along the lines of seL4/Nova/Genode for building secure systems? [1] http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-different-fr…

2 4

Fwd: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet)
by grarpamp 12 Feb '16

12 Feb '16

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, 11 Feb 2016 12:59:38 -0800 Subject: Re: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) To: Phillip Hallam-Baker <phill(a)hallambaker.com> Cc: cryptography(a)metzdowd.com At 08:49 PM 2/9/2016, Phillip Hallam-Baker wrote: >Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) > >A) Assume that the NSA has such a machine. I think that someone at NSA invented Bitcoin to supercharge the development of fast encryption/decryption chips. New forms of QC-resistant XXXcoins will be developed for similar reasons. How to leverage NSA's research $$$$$$$$$$$'s. It seems to have worked! Recall that "miners" get paid in Bitcoin, but chip developers get paid in real $$$. Algorithm/SW developers don't need to get paid at all, because they do it for the love of computer science, society and world peace. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 2

Re: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet)
by grarpamp 12 Feb '16

12 Feb '16

On 2/11/16, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > On Thu, Feb 11, 2016 at 2:12 PM, John Levine <johnl(a)iecc.com> wrote: >>>A,B) Anyone with a QC could use it to break the keys of the wallets >>>holding $500 million. >> >> Which is under 5% of the NSA's annual budget. Also keep in mind that >> bitcoins are extremely illiquid. The largest bitcoin transaction I >> can find where the buyer got something of identifiable value was a >> $500K villa in Bali. (The so-called $147M transaction doesn't count >> since there's no evidence of goods or services on either side of it.) >> Fencing a thousand villas seems pretty hard. >> >> If I wanted to use my NSA connections or my quantum computer to enrich >> myself, this doesn't strike me as a particularly good way to go. > > I was asserting that the funds would be diverted for personal > purposes, not to fund the agency. > > $500 million might be chump change to the agency but Hanssen defected > for a lot less. There is only one purpose for an entity to crack any currency and that's to kill it. Because any cracked wallets would instantly make worldwide headlines and the currency would go to zero within a day. Depending on the speed of the adversary, you might be able to migrate crypto fast enough to save some wallets but the losers will be throwing realworld pitchforks, that will roll all the way up the legal politik chain until the pressure is unbearable. The entity isn't going to be able to recoup its costs in a zero market. Even cracking supposedly dead wallets is risk of zero without proof of deadness, granny might still have her mitts on them and be watching every day. Since an entity full of people is unlikely to be able to keep a secret kill secret, they'd be better off accelerating mining, selling in a stable market. Perhaps that's what's happening now... ;) http://bitcoin.sipa.be/ If an entity has a crack it probably can't use it, and the same scenario applies if a rogue within it appropriates it for their own purposes. And for any independant loner who discovers it. They only have odds at a few wallets before they hit the wrong one and news breaks. And for them it will be all about the lulz. Either way, digital currencies will come and go, and are here to stay. Unless Bitcoin solves its serious scalability and anonymity issues, people will probably be slowly trading out of it into something else within the next 5-10 years anyway. If that something else is significantly better and stronger, you might see some cracking then in attempt to cash out. BTC from 1250 to sub 200 didn't seem to trigger any.

1 0

[Fwd: Multiple Internets]
by Ted Smith 12 Feb '16

12 Feb '16

In an effort to re-seed discussion about cypherpunk topics I'll be reposting old threads from the cypherpunks list in a rough "this day in cpunks" effort. In this mail, John Young analyzes the subclasses of "the internet" as a user might see. Optional discussion questions: * How has this dichotomy survived the intervening half-decade? * Taxonomies sometimes afford conception of novel categories; the original periodic table was mostly empty, not-filled with elements yet to be discovered. What internets can we conceive of that do not presently exist? -------- Forwarded Message -------- > From: John Young <jya(a)pipeline.com> > To: cypherpunks(a)al-qaeda.net > Subject: Multiple Internets > Date: Mon, 08 Feb 2010 07:01:38 -0500 > Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 > > > i say again: > > twitter is ruining the internets... > > I agree, but I think it's highlighting an underlying issue that we've > been letting the wrong sort of people on the internet for a long time. > I tend to think that if this type of people ends up sticking to the > world of twitter and facebook and co, then we can safely caution them > off and just ignore them at large, so for that purpose it works well > > ------ > > Multiple, discrete internets are coming into play, perhaps have always > existed. > > First, the known internets, utilizing ubiquitious access logging which > under guise of administration allows universal spying: > > 1. The internet run by operators of the overall background system > which most users know little about or care. > > 2 The open policing apparatus of the overall system run by governments > and their contractors and cooperating non-profits. > > 3. The commercial internet providing services or products for pay. > > 4. The non-profit, open-source, volunteer internet providing services > or products at no cost or for donations. > > 5. The closed sub-internets, mil-gov classified, SCADA, restricted > and special purpose networks used by operators and administrators of > backbones, nodes, satellite, cable, wired and wireless systems, > > Second, the unknown internets, with or without evident access logging: > > 6. The covert policing and spying internet which watches, logs, > mucks around, runs stings, causes accidents and shut-downs, cuts > cables, runs surprise tests and attacks, and keeps alive the demand > for covert oversight of all the known others. > > 7. The covert internets which hide among all the others, or try to > subject to discovery by 6. > > 8. The evanescent internets which are set up, used and disappear > quickly, openly or covertly, subject to 6. > > 9. The wayward and waylaid internets which cannot be identified: > rogues, experiments, mistakes, erratic systems, unexpected > glitches and consequences, acts of nature, forgotten protocols, > inept code, destructive code, lost access techniques, death > of the perpetrators. > > 10. Internets of combinations, hybrids, deceptions, ploys and > warfare among 1-9. -- Sent from Ubuntu

7 14

Fwd: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet)
by grarpamp 12 Feb '16

12 Feb '16

---------- Forwarded message ---------- From: Phillip Hallam-Baker <phill(a)hallambaker.com> Date: Tue, 9 Feb 2016 23:49:40 -0500 Subject: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) To: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) A) Assume that the NSA has such a machine. >From A it follows that the machine can be used to forge bitcoin transfers. B) Large areas of the bitcoin mining pool have never been spent. A,B) Anyone with a QC could use it to break the keys of the wallets holding $500 million. C) This has not happened. D) The NSA has awful internal security, (see Snowden). NSA resources are known to have been diverted for LOVINT. It is unlikely NSA employees are more honest than those of federal law enforcement whose investigator ripped off the Silk Road operator for at least half a million. The third in command at the CIA was recently prosecuted and copped a plea for participating in the 'Duke' Cunningham bribery ring poker and prostitutes parties at the Watergate. Oh and Secret Service... need I go on. C,D) it follows that the NSA is not capable of breaking bitcoin Therefore NSA does not have a quantum computer (yet). _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 4

request for comment re "contributor-covenant.org"
by Zenaan Harkness 12 Feb '16

12 Feb '16

Hi cp-ers, On the PostgreSQL database mailing list pgsql-general(a)postgresql.org , they are discussing a Code of Conduct. A reference and discussion came up around contributor-covenant.org and it seems many (allegedly 1000's of "open source projects" have "adopted" it, and there appears to quite the campaign to "encourage" the PostgreSQL project to likewise adopt that particular agreement. The pgsql old hands appear to have rejected it. This is a rare thing AFAICT. There are a few issues raised about the so-called "contributor covenant" which have very clearly, and repeatedly, not been responded to, and this has been pointed out, more than once. Those who chaperone one or more "open source" project mailing lists may wish to bring themselves up to speed with this so-called "covenant" before the steamroller hits your group/ list/ community, since it seems inevitable at this point. Being riveted and enraptured by concepts of "enforcement", "protection" of "the marginalized peoples" and as y'all know, my raving crusade to further promote "political correctness", I figured I should go and read this "covenant" to find out what all the fuss might be about and add some scare quotes at appropriate places. So I went and read it. It simply, abso-firetruckingly, demands a response, and beyond what appears to have currently been tippy toe on eggshells burped out so far. Here is my first draft to respond to it, I encourage others to refine my oh-so-subtle analysis, but most importantly to bring yourself up to speed with the PC-speak which might freight train into one or more of your "open source" worlds in the relatively near future; informed ahead of time may be enough to be armed against long and actually divisive email discussions, as internet searching sadly tells. The below is my second woeful attempt to bring some sanity to that "covenant". It needs your improvements. Good luck, Zenaan ---- http://contributor-covenant.org/ >> Contributor Covenant >> A Code of Conduct for Open Source Projects. Sounds reasonable. >> Open Source has always been a foundation of the Internet, and with the advent >> of social open source networks this is more true than ever. Let's hope free libre and open source software - FLOSS, stays as the foundation of the Internet! "social open source networks" - what?? Facebook social network?? Use of new terminology, without explaining that terminology, and presuming it is known and well understood terminology, in a document you are pushing as a new and additional "social contract" which others are pressed upon to adopt and enforce, is IMHO passive aggressive. >> But free, libre, and open source projects suffer from a startling lack of >> diversity, with dramatically low participation by women, people of color, and >> other marginalized populations. Those who have an interest in promoting, assisting, sponsoring and generally facilitating "the diversity" within this particular libre software project or mailing list, are welcome to do so and in general, ought be supported to the extent that their actions and words are neither actively nor passively aggressive towards any member of this mailing list, and are actually supportive of the technical goals of this project. >> Part of this problem Lack of diversity may be viewed as a problem. Such a viewpoint is a personal, individual matter. Your personal, individual opinion on this matter may be discussed, but in general is off topic for this mailing list. Speaking or writing that "lack of diversity is a problem", and even moreso, building the presumption into the words of a so-called "social covenant", where that presumption is almost hidden and "not up for debate", is a passive aggressive approach to communication with others who may or may not disagree with this position. Passive aggressive communication is not welcome on this mailing list. >> lies with the very structure of some projects: What is "the very structure of a project"? This phrase is too generic, and not explained, despite the next part of that sentence which follows below, which appears to pretend to answer (or define) the phrase - it does not. Phrases and terminologies used out of context and having indefinite and vague meanings, is a sign of passive aggressive communication and all members of this mailing list are encourage to ridicule such communication. >> the use of insensitive language, thoughtless use of pronouns, assumptions of >> gender, and even sexualized or culturally insensitive names. Although certain social niceties are encouraged on this mailing list, they are not required and indeed firm, clear and precise languaging is valued and encouraged. If you are overly sensitive, or in need (or desire) of an emotionally sensitive environment, then consider another mailing list - this mailing list is likely not for you, and if you are in need of any professional help, you are encouraged and indeed required to seek professional medical and or psychological advice and or support. >> Marginalized people also suffer some of the unintended consequences of >> dogmatic insistence on meritocratic principles of governance. There are forums and mailing lists which are suitable for those who have learning difficulties (reference?), for those who need an emotionally sensitive environment (be sure to check if you need professional medical or psychological support), and for those who are beginniners in the field of technology discussed on this mailing list. In all of these cases, this mailing list is not for you, and you will be encouraged to leave if we discover that any of these conditions apply to you. Take note, we heartily welcome the opportunity to joust against your best attempts to otherwise deceive us in regards to such conditions applying to you, although in general in such cases, please expect derision and ridicule for wasting our time in such circumstances. >> Studies have shown that organizational cultures that value meritocracy often >> result in greater inequality. This is a baseless assertion. Provide the references or go away. Such an unsupported, unreferenced and 'plastic' attempt to dominate our community into conforming, acting and behaving according to your standards is unwelcome in the extreme, and grounds for the ridicule of you. In any case, this mailing list is for those who have a minimum intermediate skill and understanding in the programming languages and technologies for which it has been established, and is explicitly not for those who are overly sensitive and need an emotionally supportive environment - we might have a laugh, and it may be at your expense, so if you can't laugh at yourself, this mailing list is definitely not for you. >> People with "merit" are often excused for their bad behavior in public spaces >> based on the value of their technical contributions. You may join this mailing list, but by doing so you agree to speak clearly and assertively if you feel offended, or otherwise to respectfully leave the mailing list, as it is unmoderated and uncensored, although discussion is generally sought to be on topic, and for offtopic digressions to be kept short and taken offlist or to an alternate list if they persist. Additionally, your consideration that this mailing list is a public space, is only partially correct. This mailing list is a list which is open to conditional membership, and the list administrator reserves the right to ban you temporarily and or permanently at any time, but with prior notice and opportunity for discussion given on this mailing list. Take Notice further that the discussions had by members of this mailing list are archived publicly, so to this extent the list may be considered public, whilst it is strictly a members only mailing list who choose to have certain public discussions, which may include attempting to ridicule -you-, so obtain a temporary membership to this email mailing list only after very careful consideration by you. If you are at all unsure of your suitability to our list, we are happy to help you decide by analysing your proposed introduction email of yourself. >> Meritocracy also naively assumes a level playing field, in which everyone has >> access to the same resources, free time, and common life experiences to draw >> upon. The sentence above is another passive-aggressive, presumption filled projected assertion. Such communication has no place on this mailing list, except as the target of naming the presumptions, highlighting the passive aggressive nature and generally tearing it to shreads and providing an opportunity for the mailing list members to laugh like hyenas. - >> "Meritocracy naively assumes" Meritocracy does no such thing - it is not a person. - >> "Meritocracy also naively assumes a level playing field," Meritocracy does no such thing - in fact it is the opposite - meritocracy is a socio political agreement, contract and or requirement that participants in the system shall be judged based on their technical merit and or performance. In our case, slow performance is entirely acceptable, you are under no requirement nor expectation to make contributions according to any schedule, only on your own free time and personal pleasure. Making any assertion to the contrary is passive aggressive, manipulative, and shall be joyously and most light heartedly attacked in words. - >> "in which everyone has access to the same resources, free time," No such assumptions are made on this mailing list, and quite the contrary - if you have very little free time for example, or a slow computer, then we will certainly expect that your contributions may be few and far between as compared with someone who has loads of free time or a faster computer than you. If you are experiencing free time and resources problems, then this list is DEFINITELY not the place for you - you are explicitly instructed to seek professional time management advice as well as professional financial counselling. DO NOT bring such personal problems to this mailing list, as they will be used as instant grounds for removal and for barring from the list, although more likely simply as grounds for ridicule and laughing like hyenas. - >> "and common life experiences to draw upon." Once again, "meritocracy" (to the extent we can personify a socio political system), and "we" the members of this mailing list in particular, make no such assumptions whatsoever, and we more importantly, put no such requirements upon you. So sleep tight, it's all alright, we won't hold your differing life experiences against you, in fact we may be intrigued, but if a particular experience you share starts to cause an extended off topic discussion, take notice that we reserve the right to calmly let you know this so that we can get back to the topics intended for this mailing list. This list may be a platform, but at most only for those robust enough to hold their own on the topic they make a post about. If you join this mailing list, you are strongly encouraged to communicate your personal concerns and problems, needs and requirements at the earliest stage possible, preferably in in your introduction email with a well identified subject line. Then we will be able to readily assess whether this mailing list is suitable for you or whether you need to find another, more appropriate environment in which to express yourself and or to find a "contribution space" which is suitable for your needs. If you are unsure, then you are welcome to introduce yourself in this way, and we will respectfully assess your suitability to the mailing list as best we can. Take notice that we are not professionals in any field, indeed we are amateurs that might be in your personal medical or other interests to NOT associate with, and that if you require any professional advice, medical or otherwise, then you are required to seek such advice from suitably certificated professionals in your area - we on this mailing list cannot help you in such circumstances and if you fail to inform us of any such problems and or issues you may have that you consider we would otherwise be responsible for, then you may be in breech of the legislation in your jurisdiction - deceive the members of this mailing list at your own legal liability. On this mailing list, robust communication is a prime valued contribution - if you are actively wanting to improve your emotional robustness, this mailing list could possibly be a suitable place for you - feel free to ask us about this specifically in relation to you. >> These factors and more make contributing to open >> source a daunting prospect for many people, If your emotional strength, your social and or communication capacity, and or your psychological needs are an issue in any way, you are not welcome on this mailing list and we require you to seek professional medical advice. >> especially women and other underrepresented people. (For more critical >> analysis of meritocracy, refer to this entry on the Geek Feminism wiki.) If you have any trigger words, emotional weaknesses and or sensitivities which may cause you to have any reaction whatsoever, you are required to inform the members of this mailing list in an introduction email if you do join the list, and if you are required to do so, you must seek professional medical and or psychological advice and support - this mailing list is most likely an inappropriate place for you to join, and we continue to encourage ourselves to not hold back in reminding you this. >> A Small Step Forward >> An easy way to begin addressing this problem You may have some problem, and this mailing list not the place for you to fix your problem. Only technical matters related to the technical topic of this mailing list are appropriate problems for fixing in discussions on this mailing list. Seek professional advice when you need it, including professional advice regarding the technical topic of this mailing list if that is what you require - this mailing list is for non professionals with at least moderate technical competence, all members are volunteers, all members participate at their own discretion and with no obligations upon them and with no obligations whatsoever to you, including courtesy which is valued, but not required - enter at your own risk. >> is to be overt in our openness, welcoming all people to contribute, and >> pledging in return to value them as human beings and to foster an atmosphere >> of kindness, cooperation, and understanding. This we agree with - we, the members of this mailing list, proclaim our intention to welcome all people to contribute, and to value each member as a human being. We encourage each other to foster an atmosphere of kindness, cooperation and understanding, and robustness in communication - passive aggressive communication, despite the best intentions of the one making such passive aggressive communication, has no place in our community. And take notice - persistent bad behaviour, 'bad' by the assessment of the members alone and discussed publicly on this mailing list, shall be cause for temporary and or permanent banning from this mailing list. >> The Contributor Covenant can be one way to express these values. Pledge your >> respect and appreciation for contributors and participants in your open >> source project by adding an explicit CODE_OF_CONDUCT.md to your project >> repository. Respect, kindness and cooperation are good things, but this "http://contributor-covenant.org/" "contributor covenant" to which we hereby respond, is in no way or shape getting into our project's repository without this our response. >> The Contributor Covenant uses semantic versioning for revisions so all URLs >> are permanent. Previous versions are available here: 1.0, 1.1, and 1.2 >> Using the Contributor Covenant >> We recommend that you add the Markdown or text version of the Contributor >> Covenant to your source code repository at the root level. >> Thanks to Simon Vansintjan there is an automated way to add Contributor >> Covenant to your project. Assuming that you have node installed, simply run >> the following two commands from your project folder: >> npm install -g covgen >> covgen your_email_address >> You may want to add language similar to this to introduce your code of conduct: >> Please note that this project is released with a Contributor Code of >> Conduct. By participating in this project you agree to abide by its >> terms. >> You may also use the permalinks given above to reference from your project >> home page. >> Important! You must add a contact method to the placeholder in the document >> so that people know how to report violations. Enforcing the Contributor >> Covenant This above paragraph does not quite feel right. If the members of this mailing list are so anti-social that genuine "social problems" cannot be resolved on the mailing list itself, then this "community" of members is quite likely beyond repair without substantial work by robust individuals with a passion to heal the community - if you are not such an individual, then you best leave that job to comeone who is, and take yourself to a kinder, gentler happy place. >> Do not simply add the Contributor Covenant to your project and assume that >> any problems with civility, harassment, or discrimination will be solved. As >> a project maintainer you must be committed to enforcing the code of conduct. There may be a time and place for banning members from this mailing list, temporarily and or permanently, but such discussions shall continue to be public, on the mailing list itself and open to discussion and contribution by all members. No duty is incumbent upon any member, including the "project maintainer" - if the community can't work out its problems, it is unfair to place such a burden upon such a one individual. >> A code of conduct without enforcement sends a false signal that your project >> is welcoming and inclusive, and can create a dangerous situation for >> marginalized people who participate. "Marginalized people" who are not competent to contribute on some technical level (which includes documentation writing, testing as well as programming), are not welcome - we the members of this mailing list are volunteers and, on this particular mailing list, are not willing to tutor those who have special needs - do not join the mailing list in such circumstances, there are other, appropriate forums, mailing lists and learning institutions which you ought apply to. Genuinely anti-social communication is actively discouraged, and this includes those who communicate deceptively regarding their own needs and or social environment requirements, as well as those who communicate in a passive aggressive way. If you this any of these types of communication may apply to you, then be prepared to suffer the consequences should you join this mailing list - we shall roast you in words, with glee! >> Adding the Contributor Covenant to a project places responsibility on the >> project team that must not be taken lightly. Since the archives of this mailing list are public, should you have even the smallest concern regarding your own robustness in public communication, then you are invited to browse those archives and make an assessment as to whether you are a suitable candidate to join this mailing list. If you do decide to join, you are required to make your first email an introduction, which introduction includes a reference to your assessment of the archives as well as any needs you feel that the members of this list ought be able to meet. >> Before adopting the Contributor Covenant take the time to discuss and decide >> how to deal with problems as they emerge. Document the policy and procedure Oh, we've taken the time, and "problems as they emerge" shall be handled publicly, on this mailing list! To the extent we the members of this maliing list consider you a problem, passive aggressive or otherwise, we WILL handle you, publicly, with the one caveat that all members are in general expected to show respectful consideration in respect of all private or "off-list" communications. If you are uncomfortable with this policy, you are encouraged to find a more suitable community to join. >> for enforcement, and add it to your README or in another visible, appropriate >> place. Consider if your project team has the willingness and maturity to >> follow through on your enforcement procedures. A "community" that requires any significant policing, particularly clandestine policing, has lost its way - the tyranny of the majority is not the healthiest way, in the opinion of some members - speak clearly, speak the truth, and seek a fair response; if you don't receive a fair response, another community might be much less work for you, even if it provides less opportunities for emotional growth for you.

12 19

Cryptsy theft->bankruptcy
by dan＠geer.org 12 Feb '16

12 Feb '16

...You probably want to see the article (jpegs of relevance)... www.databreachtoday.com/bitcoin-heist-steals-millions-from-exchange-a-8803 Cryptsy Faces Potential Bankruptcy Over Just-Revealed 2014 Hack Mathew J. Schwartz (euroinfosec) o January 15, 2016 Bitcoin Heist Steals Millions from Exchange Cryptocurrency exchange Cryptsy, which trades bitcoins as well as more than 100 types of "altcoins" such as litecoin and namecoin, disclosed Jan. 15 that it was robbed in 2014. As a result of the breach, the exchange has now suspended all trades and says it will file for bankruptcy unless the stolen bitcoins are returned. Florida-based Cryptsy says the attacker stole 13,000 bitcoins, worth $5 million today, as well as 300,000 litecoins, worth $970,000 today. The exchange says the theft was not related to the recent phishing and distributed denial-of-service attacks that it's suffered. It suspects that the most recent developer behind Lucky7Coin - LK7 - is the culprit behind the attacks, based on a backdoor that it found inside its network. "About a year and a half ago, we were alerted ... a reduction in our safe/cold wallet balances of bitcoin and litecoin, as well as a couple other smaller cryptocurrencies," Cryptsy says in a blog post. It says its investigation ultimately found that the developer of the Lucky7Coin cryptocurrency "had placed an IRC backdoor into the code of wallet, which allowed it to act as a sort of a Trojan, or command-and-control unit." The exchange adds: "This Trojan had likely been there for months before it was able to collect enough information to perform the attack," which was executed on July 29, 2014. A user of code-sharing site GitHub in March 2015 detailed that apparent backdoor in the Lucky7Coin IRC code, noting that it would give an attacker "the ability to run arbitrary commands on the victim's host." Cryptsy suspects that whoever originally developed Lucky7Coin isn't responsible for the backdoor, but rather someone named "Jack," who claimed to have taken over development of the cryptocurrency codebase and related code, and who contacted Cryptsy on May 22, 2014. "You're the only exchange for this coin and I hope you will let me take care of it. I'm responsible," Jack claimed. Message From New Lucky7Coin Developer [Cryptsy-720.jpg] Cryptsy says it fell for a Trojan attack initiated by "Jack." Connection to Jailed 'Silk Road' Secret Service Agent Cryptsy is not the first exchange to have faced insolvency after hackers stole its bitcoins (see Bitcoin Exchange Hacked With Word Macro). But why didn't the exchange come forward sooner? Officials at Cryptsy couldn't be immediately reached for comment. But in the blog post, Cryptsy says it initially tried to cover the missing funds using its exchange profits and appears to suggest that everyone would have been worse off, had it gone to authorities, because its U.S. Secret Service contact was none other than Special Agent Shaun Bridges. "I think we all know what happened with him," the Cryptsy blog post notes. In August, Bridges pleaded guilty to both money laundering and obstruction of justice. He was accused of abusing his position while a member of the Secret Service's Electronic Crimes Task Force that was investigating the notorious darknet narcotics marketplace called Silk Road (see Former Secret Service Agent Pleads Guilty to $800K Bitcoin Theft). Cryptsy, which is a member of the Financial Crimes Enforcement Network, also says it attempted to contact the FBI Miami field office recently, but was redirected to the Internet Crime Complaint Center. IC3, as it's also known, is run by the FBI, the National White Collar Crime Center and the U.S. Bureau of Justice Assistance; it deals with Internet crime complaints (see Hackers Claim FBI Information-Sharing Portal Breached). The exchange says it has yet to hear back from IC3. Will Missing Bitcoins Come Home? Cryptocurrency news site CoinDesk reports that declining trading volumes have undercut the exchange's profits and that the exchange has halted trading twice in the past two weeks, blaming one of those outages on a phishing attack that employed users' email addresses and phone numbers. But a class-action lawsuit filed Jan. 13 against Project Investors - doing business as Cryptsy - and Paul Vernon, who it says is the founder, operator, and CEO of Cryptsy, alleges that since November 2015, "certain Cryptsy users started having difficulties and inabilities withdrawing any and all forms of currency from their accounts." The plaintiff, Virginia-based Jinyao Liu, "seeks damages based upon the unlawful conduct of defendants in denying account holders the ability to obtain funds in their accounts and in misappropriating funds held in the Cryptsy accounts," according to the lawsuit. Thank you everyone for the patience while we get these issues resolved. Team is working hard and we will try to do more frequent updates. BigVern (@cryptsy) December 10, 2015 In its Jan. 15 blog post, Cryptsy says it now faces a 10,000 bitcoin ($3.8 million) shortfall and identifies three available business options: It shutters the website and files for bankruptcy; someone purchases the exchange and makes good on the requested withdrawals; or the attacker returns the stolen bitcoins - no questions asked. While that might sound far-fetched, Cryptsy says that after the July 29, 2014, theft, based on the bitcoin wallet address tied to the theft, "those bitcoins have not moved once since this happened" which "gives rise to the possibility they can be recovered." To help, Cryptsy has offered a reward of 1,000 bitcoins ($380,000) for "information which leads to the recovery of the stolen coins." Bye-Bye, Litecoins Cryptsy doesn't reference the fate of the missing litecoins. But they appear to have been cashed out: On July 2, 2014, someone dumped exactly 300,000 litecoins - quite a coincidence - onto an exchange all at once, which was such a large volume of coins that it temporarily drove down the price of each individual litecoin from $8.50 to just $2. As noted on a related Reddit conversation: "The volume was so high that he basically chewed through the entire buy side of the order book, all the way down to someone who had (probably on a lark) put in a buy order at $2," reports Reddit user FreeJack2k2. "After clearing out the ask side of the order book, the new sell orders only dropped to the low $7 range (the recovery from $2 was immediate) and eventually got bought back to where we are now, at around $8. Whoever had that $2 buy order in the books made out like a bandit."

2 1

Self Preservation and Irreversible Decline [was: Electronic Freedom Foundation selective in support of freedom]
by coderman 12 Feb '16

12 Feb '16

On 1/6/16, Sean Lynch <seanl(a)literati.org> wrote: > ... I've found myself self-censoring quite a lot more > since my kids were born. this topic has been on my mind recently, "You know, It would be a lot easier you just didn't do X" "This wouldn't happen if you quit annoying Y" "If you accept, Z will pay nicely and protect you." where X is FOIA requests, security research, PET development, etc., Y is some powerful entity like FBI, NSA, Verizon, Intel, etc., and Z is some convenient but forever bound by position requiring a clearance and suspension of moral qualms. when you've got the world to loose (nothing more encompassing than your own family!) preservation is near irresistible. simple fear of harm might be compelling enough for the majority to cower compliant, even. --- when i was young, these questions of "do i do right? or do i stay safe?" were abstract and applicable only to foreign backwaters or past history. a modern, free liberal democracy need never exercise such restraint - we have Blind Justice which always finds in favor of the righteous! over some years i lost this innocent faith in perfect justice, saw abuses of power against the less fortunate or less familiar, accrued things dear to me like friends and new family, and became comfortable in a lifestyle with all needs met. . . . now USA in a state of perpetual war, executive power at record levels, surveillance staggering in breadth and invasiveness, censorship and suppression of speech creeping ever further into the centralized systems dominating over our way of life, it's not good... and yet we're not rounding up foreign-born citizens and their families for incarceration at detention camps (like Japanese during the war). not to mention that much of the rest of the world would be killed or imprisoned leading my kind of life in another jurisdiction! when people are being killed for exposing corruption or injustice, it seems ridiculous to complain about annoyances resulting from optional activities i have chosen to undertake willingly - not out of dire need or coercion. with all my needs still met. --- all of which made me wonder, what did the every day German or Italian citizen see before fascism ravaged sanity? what did they see that felt disturbing, but not overtly threating and could be ignored? what did they see which told them all legitimacy was lost and only resistance remained? the #YallQueda rebellion staged their last stand in my state, with land use abuse the straw upon their broken backs. perhaps loss of livelihood a better Rubicon? --- then another "If you quit doing that, it would all be much easier..." was said, and i wondered if this was the key sign of trouble i was fearing to see. when lawful activities performed for the good of the public draw unjustified scrutiny and disruption from the state, has the state itself become corrupt? how far must this corruption spread before it cannot be stopped without destruction of the state, no matter the size and vehemency of public protest? can the tools of technology and manufactured consent provide the state ability to become completely corrupted without detection, nor resistance from the public? --- i don't know the answers, and i am curious to hear opinions. i still live a rich life with needs met and i don't think we're on the brink of a fascist nightmare future. maybe hell on earth is closer than i think... thoughts? best regards, NOTE: i am using the terms fascist and fascism explicitly, not capriciously. ''' Fascism is a form of radical authoritarian nationalism that came to prominence in early 20th-century Europe... Fascists saw World War I as a revolution that brought massive changes in the nature of war, society, the state, and technology. The advent of total war and total mass mobilization of society had broken down the distinction between civilian and combatant. A "military citizenship" arose in which all citizens were involved with the military in some manner during the war. The war had resulted in the rise of a powerful state capable of mobilizing millions of people to serve on the front lines and providing economic production and logistics to support them, as well as having unprecedented authority to intervene in the lives of citizens. Fascists view World War I as having made liberal democracy obsolete, and regard total mobilization of society under a totalitarian one-party state as necessary to prepare a nation for armed conflict and to respond effectively to economic difficulties. Such a state is led by a strong leader — such as a dictator and a martial government composed of the members of the governing fascist party — to forge national unity and maintain a stable and orderly society. Fascism rejects assertions that violence is automatically negative in nature, and views political violence, war, and imperialism as means that can achieve national rejuvenation. ''' - https://en.wikipedia.org/wiki/Fascism

12 38