- cypherpunks - lists.cpunks.org

[Cryptography] Plug for crypto.stackexchange.com
by Eugen Leitl 13 Oct '13

13 Oct '13

----- Forwarded message from David Wagner <daw(a)cs.berkeley.edu> ----- Date: Sat, 12 Oct 2013 19:35:04 -0700 From: David Wagner <daw(a)cs.berkeley.edu> To: cryptography(a)metzdowd.com Subject: [Cryptography] Plug for crypto.stackexchange.com Message-Id: <1381631704.24985.33312825.0DBEAC1B(a)webmail.messagingengine.com> X-Mailer: MessagingEngine.com Webmail Interface - ajax-ce174988 I've noticed quite a few questions on this list recently of the form "How do I do X?" "What is the right cryptographic primitive for goal X?" etc. I'd like to plug the following site: http://crypto.stackexchange.com/ Cryptography Stack Exchange It is an excellent place to post questions like that and get helpful answers. I encourage folks to give it a try, if they have questions like the ones I listed above. By posting there, you will not only get good answers, but those answers will also be documented in a form that's well-suited for others with the same problem to find and benefit from. I'm not trying to drive people away from this mailing list, just pointing out an additional resource that may be helpful. Or, if you're feeling helpful and community-minded, you can subscribe and help answer other people's questions there. (That site is like Stack Overflow, for those familiar with Stack Overflow, except that it is focused on cryptography. There is also a site on information security: http://security.stackexchange.com/ ) _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] What are some free and private email providers?
by Eugen Leitl 13 Oct '13

13 Oct '13

----- Forwarded message from Johnny Carson <BM-2cWsmYXZ1wDRbXAriL1tFwmsm4mbCAqD9Q(a)bitmessage.ch> ----- Date: Sun, 13 Oct 2013 01:30:39 +0000 From: Johnny Carson <BM-2cWsmYXZ1wDRbXAriL1tFwmsm4mbCAqD9Q(a)bitmessage.ch> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] What are some free and private email providers? Message-ID: <5259F7BF.8060703(a)bitmessage.ch> Reply-To: tor-talk(a)lists.torproject.org Joe Btfsplk: > On 10/12/2013 3:52 PM, Edgar S wrote: >> I was also left hanging when tormail shut down. I've found one that >> meets my needs. Based in Switzerland. It is Tor-friendly for both >> signups and webmail. Has both an onion hidden address, >> http://bitmailendavkbec.onion, and an open address, bitmessage.ch. Free. >> The only drawback is that you have to accept an assigned username that >> is a long string of random characters. >> >> Another possibility is URSSMail http://urssmail.org/ >> http://f3ljvgyyujmnfhvi.onion. Based in Russia and Brazil. Neither are >> very friendly to the NSA. It seems to have some problems currently. I >> thought I had created an account, but then I couldn't log into it. But >> it lets you assign your own username, and is free, although BTC >> donations are requested. As I write, the hidden service is down. > I guess you went thru part of the signup process to see it assigns a > random string as your acct username / email address? > It told me the registration was "having problems." How long was the > random assigned name? > > That'd be a bit tough sending mail to general people. But, if you want > privacy... > I wonder if there's an option to enter a name that goes in front of the > email user name, like most clients or even ISPs allow? > > I guess it'd be fine for typical mail, but the entire size per message > limit is 2 MB. I too use Bitmessage.ch by their hidden service address (SSL). I use Torbirdy with Thunderbird. When I send emails to people I just enter a name into Thunderbird and that's the name a recipient sees. The email address of course is long, but I haven't found anyone that seemed to care. I dont send big files though, the 2 mb limit is low. A trace of an email sent through Tor and then Bitmessage and then to the recipient shows Tor exit node IP address, without usable metadata AFAIU what Bitmessage.ch does for metadata. There's a new Tor Mail Gateway coming online and it sounds bad ass: https://www.whonix.org/wiki/Special:AWCforum/sp/id429 https://lists.torproject.org/pipermail/tor-talk/2013-August/thread.html#294… https://github.com/moba/tor2mail -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[15] perimeter observat!ons
by brian carroll 13 Oct '13

13 Oct '13

--- code characteristics --- i was going to attempt a real-world example though it is too complicated without computer tools and lack of mathematical skills to provide a deep enough reference for real world crypto requirements. there are several ideas for using HIOX as calculus and set theory permutations that could have direct relevance yet to actually get into it this functionality is more than email provides as a communications medium. thus, in considering this possibility a generic example was considered in the typical approach, to introduce a programming language. yet even this is limited and tends to the computational enigma or knotted condition inherent in the dynamics it involves. and thus, instead of providing one of likely thousands of approaches, it was instead decided that a limit of trying to approach this situation would be provided, to get at the unique existing conditions of considering the mathematic of language and vice versa. HELLO WORLD if considering the above statement, what is interesting to me about their combined signage is that 7 of the 10 letters can be resolved in within the numeral '8' which also is the seven-segment LED display. thus the letters (H, E, L, L, O, O, L) can all be compressed into a single symbol and in its partial capacity to represent specific alphabetic patterns -not all- the domain for potentially mapped letters into a mystery word has less than 26 options of the alphabet itself: 88888 W8R8D this assumes the rectilinear seven-segment LED display or other rectilinear alphanumeric character is the basis for a common typographic standard. it has a Wheel of Fortune gameshow aspect to it, certainly. consider then a general wildcard condition, any letter number or symbol, in comparison: ***** W*R*D what does it mean. well, if it was known that there are two words, and the number count of a shared symbol containing the necessary letter is 7, then it narrows down this potential for 26+ letters +10 numbers +other symbols into a realm tending towards a limited alphabet, focused on letters alone. and if this was a known structure, then evaluation could proceed based on what is most likely within these given parameters. 88888 W8R8D for the second word ('WORLD') the more intense HIOX or Union Jack 16 segment LED display symbol would be necessary to map the remaining letters (W, R, D). thus consider that two different patterns potentially exist that could map the two words in a permutive range, such that: 88888 *8*8* in this example the asterisk would actually be the Union Jack or 16 segment display, while the '8' would be equivalent to a 7 segment display. a number sign is going to be substituted instead, to not mistake it for a general wildcard existing beyond the alphanumeric framework... 88888 #8#8# so imagine that the number sign above equates with the HIOX symbol for the remaining letters W, R, D. while the first word and several letters of the second are contained in the generic 7 segment display and its alphabet, it begins in a minimal condition already compared to the more elaborate 16 segment display. yet if considering the letters W, R, D within that context those letters when overlaid in its structure do not require the full symbol for their combined representation, that can be compressed in a shared state of superposition. please look at the following mapping of the 'segments' as annoted at from the website of a 16 segment display manufacturer... APPLICATION NOTE 1131 http://www.maximintegrated.com/app-notes/index.mvp/id/1131 each of the sixteeen segments has its own specific letter or letter-number combination to help describe what parts of the LED are turned on and off, to help map this to pin-out diagrams and programming instructions for an IC display driver else microcontroller. considering that the remaining letters in the second word (W, R, D) do not require all sixteen segments to be illuminated at once to contain all of these three letters as a potential query reply, a specific symbol could be mapped out of this 16 segment display that is closer to a 7 segment LED display ('8') with some extra detailing, equivalent to a connection from the upper left to lower right, and from lower left to middle center. yet as the 16 segment display is wider and bifurcated down the centerline (to allow letters such as W to exist, as a mirroring of two letters V|V), this comparison is only descriptive and would require the 16 segment display to start with, as the 7 segment has no diagonals or centerline to reference. alot of description that evaporates into abstraction, potentially- yet the specific idea of this is that a minimal number of segments can establish a referenceable symbol for the remaining letters W,R,D and that this is essentially a symbol 8' with a diagonal from top left to lower right, and from lower left to the middle, approximately. in the technical terms as it relates to the annotated segments from the url above: a1, a2, b, c, d1, d2, e, f, g1, g2, (which creates the equivalent to an 8 or letter B) -and- h, k, (first diagonal), m (second diagonal). this mapping of letters onto a minimized common symbol demonstates that the 16 segment display can be minimized to a smaller format 13 segments, that then limits the potential letters that could exist and be autogenerated via bit set evaluation of the placeholder symbol (#) so in other words, HELLO WORLD could be reduced to two symbols: 8,#, whereby the first contains 7 letters and the second, which is a stand-in for a 13 active segments of a sixteen segment LED display, is a custom symbol for the remaining three letters. it is important to make clear that a single symbol (HIOX, or Union Jack, equivalent to the 16 segment LED display) could render the entire statement HELLO WORLD via one symbol and yet that would look like this, to start: ##### ##### and thus the odds are much better with the following, where only a limited amount of letters are possible for a majority of the unknown characters... 88888 #8#8# the issue of structure is what is involved in this evaluation, as a hint or clue or patterning that can help consider ways that alphanumerics already relate in terms of their own internal structuring, as a display format. in case it is not readily evident what this implies, it is that those letters represented by the stand-in symbol '8' can only render a limited amount of letters, given specific rules. thus a 'W' cannot be rendered within that form, nor a letter 'V', etc. so it narrows down what letters could exist there. and likewise for the 13 segment custom symbol, an 'X' could not be rendered nor a 'T' or other letters. and thus while the probabilities for letter combinations are probably enormous (and this is provided as a test case for computer experiment, to gauge the numbers involved in a most simple display of words) there are many fewer options that exist between a combined 7-segment and 13-segment symbol permutation than a 7-segment and 16-segment display combined, given dictionaries that could find words that may fit the given criteria. so a kind of compression or packing and unpacking could exist in relation to words and symbols, and it is a question of how this is approach and how it is dealt with. if you have one symbol for both words the approach is moot, the patterns are structureless. whereas if a sequence occurs whereby an evaluation of text considers the structure of a statement, and then explores how this may be minimized into a smaller format, given rules, it would be possible to reduce the quantity of letters via such compression, into particular or peculiar symbols, that are mapped into or back onto sentences, that may have additional numeric or other instructions as a guide for this (perhaps a shared key even). in this way, the symbol 8# with 2,5 could carry the compressed statement though lacks arrangement or sequence information to where the 7-segment letters and 13-segment letters would be placed, such that various combinations could exist in two words of five letters each... 88888 #8888 8###8 88888 these are essentially impossible computations in terms of hundreds and thousands if not many more combinations of potential words and meanings, it could easily involve tens of thousands of [word1] [word2] sequences. instruction for two words, five letters each (2,5) requires an additional set of arrangement data, such that there are seven places for '8' and three for '#'... in other words, 7('8') and 3('#') 8888# ##888 #88#8 8888# the arbitrary examples shown demonstrate the variability for this mapping and thus the original words would not be possible given the sequence if it is not capable of regenerating the correct origional pattern (HELLO WORLD) so now this is getting complicated for a simple statement, such that 7('8'), 3('#') and (2,5) remain wihtin a realm of untethered abstraction. a further structure for symbol placement within words is required, to make sure that they are correctly placed or mapped into the linear arrangement. one way of doing this would be '8'{1-5,7,9} and '#'{6-10}, whereby: 2,5 ('8'{1-5,7,9}; '#'{6-10} ) the instructions: two words, five letters each, symbol '8' for letters 1-5 (first word), 7 and 9; symbol '#' for letters 6-10 (second word) 88888 #8#8# given these dynamics, and the geometrical structure inherent in letters and numbers, it would be possible to de|con-struct words and sentences into a more abstracted format that would not be readily decipherable, if the key to unpacking the data was not shared or available. this could be as simple as a minimal superposition of letters, say a J or L that are mirror-images in a given display font that could equate with a capital letter U. and thus the placement of the 'U' could stand for both of these letters. in this way it is a question of what structures are referenced and under what specific conditions, and this need not be limited by a particular display and could instead become an issue of dots and diagonals and vertical and horizontal bars that are detached from alphanumeric signs, if an algorithm exists to process statement into this abstraction and back out again. there are several ways to approach the original situation and this is only one partial approach. another would be to take the common letters of HELLO WORLD, and address the three common letters L and two letters O, such that: L,O (HE WRD) and then perhaps again the 'H' and 'E' could easily fit into a 7-segement LED display format ('8') and the WRD as before into the 13 segments ('#') of a Union Jack LED display... L,O ('8,#') and so it goes, such that the L,O, could be L,7 and yet combine into letter O, and whatever rules may exist or be applied in a given ruleset approach. the point is about existing patterns within language as a common structure or scaffolding that has geometrical attributes that can be harnessed and that has inherent meaning in the interrelational meanings between SIGNs, in that signs can exist within other signs, embedded and-or in superposition, and that these typographic or display characteristics can be harnessed, used, adapted, in terms of their transformative ability and capacity. perhaps the above example indicates that the algorithms would be larger than the statements, yet what if the distribution was offset somehow such that data could be compressed within a Menger sponge via superset(set(subset)) nesting via Fibonacci series, or some other approach. it may involve another consideration yet somewhere they could also be connected if a means of placing data was mapped similar to rules of a chess board and the arrangement of its pieces, yet with letters and numbers and symbols. the aspect of the puzzle, such that it there is a limit to its brute-force computation yet with the correct key can be deciphered or decrypted via computation, eventually to make its way into clear text. this could be an issue of manual analysis or involve many sequenced steps, where brute-force could never break the patterns down from their abstract condition because the particular perspective for the given instance is beyond the threshold needed to allow viable computational decypting- it is basically infinite. this generic abstraction is not particularly helpful yet it provides basic context for evaluation of beginning considerations, as simple as it gets in a larger realm of computers and algorithms. and perhaps this is nothing yet though if it is not an existing approach, it potentially offers something beyond the existing interpretation or limits for how data is considered in terms of its inherent signage, and whether this is hollow represetnation or filled with symbolism and meaning by default- and thus grounded in a deeper way in terms of its actual truth or floating in a subjective confined limit that contains interpretation and allows codes to be easily conceptualized within particular parameters and conventions that are already established. the short way of conveying the same idea is that the role of TYPOGRAPHY in relation to cryptography is vital in this approach, whereas its absence in crypto calculations would also signify a lack of depth in the language and calculations used, to those of iconic signs, not within their structures. in this way the calculative aspects of mathesis, of math-language dynamics within geometrical interrelation, via trans-formational and -mutational patterning, could within its abstraction, allow estoteric computations to occur beyond the known or perceivable or modeled boundary of cryptography, for those with the keys. and perhaps this is entirely of the traditional approach, the issues of compressing statements into another secret format, yet has this occured 'infra-letter' and 'infra-number' or has it remained bounded by letters and numbers, and thus not dealing with the structural segments that de|con-struct the entirety of language into smaller bits. and so that is the question and challenge and the insanity of the probabilities in computing what an ordinary sentence could be, even having the code and potentially even the key, and yet not the perspective to view it within. in other words, how is it known what plain text viewpoint is the correct one. and thus the crucial role of aesthetics and thresholds of shared literacy. (note: the above example does not consider what would be assumed involved missing steps, such as substitutions, mirroring, and other transformative approaches implicit in this calculability and hiding information within other information or altering its signage and default interpretation. it may not require computation for SMS conveyances though for twitter-level likely would involve significant processing, though potentially massive processing if trying to brute-force crack messages and it is proposed and hypothesized this could be made impossible, quite easily (via bit sets)) (one way to conceptualize it is expansion of a bit set in a bounded range, say uncompressing a bit.set string for between 3-10 letter words, and then the key would be an algorithm that hunts and pecks data out of the expanded field via particular algorithm, in this way gathering puzzle pieces within the noise field and reassembling them locally, else locating and mapping relations within the expanded interiority as a constellation or given viewpoint which could potentially shift given what key is activated, say for instance a superposition condition of mirroring, where meaning shifts given directionality and thus ambiguity is retained by default even if an observer has some of the puzzle, they may not have the right interpretation and thus multiple boundaries or mazes within labyrinths within funhouses with trapdoors leading to dungeons within castles, false perspectives, etc. the voyeur observer or surveiller not realizing they are trapped, if ever, until it is too late and their actions are bounded, further limited, led into closed rooms that get smaller and smaller with no escape possible. the danger here for the uninitiated and opponents would be following and trying to decipher the situation. this is bamboo spear jungle trap cryptography. once they think or believe they understand- it is over. as if a reverse-form of nihilism even. the transformation of one-point perspective that is ungrounded, focused on falsity and nothingness, as everything splays out the further it is approached, nothing relates to anything, everything relates with everything. madness. loss of coherence. pure paranoia. and then the clanking and sharpening of metal, ever louder, evermore near...) --- anomaly --- for sake of completeness in the previous HELLO WORLD example, it was also discovered that it is possible to compact everything into the 7-segment LED display or rectilinear number '8', if the ruleset and instructions allow for the rotation and upper- and lower-case variability. in this way... H E L L O 3 O r L d the number 3 stands-in for the letter W rotated sideways. and thus the way that this statement could be evaluated differs from the previous approach and involves different specific instructions, as would other methods. not mentioned in this approach would be the breakdown of letters into the corresponding segments and mapping these to particular letters in their various states of potential, whether mutation or transformed. and this could even be numerical, so that no words are visible in the messaging. --- note on equality --- all observations are not equal. nor are all observers equal in their POVs. the vavlue of the observations must be grounded within truth and related within an empirical structuring to evaluate views of a given perspective. and the views that are functioning in a minor truth or pseudo-truth or partial-truth are not -equal- to those that have removed falsity from the frameworks used to model and mediate and communicate this shared truth. it may not be a possible condition today, given tools and issues of literacy, and yet, those who defer to truth are not the same as those who deny it and use it to their onesided advantage to exploit reasoning via power politics. it is an important distinction that truth does not equal pseudo-truth, it does not equate with 'allowable falsity' as part of the shared relation. that is heresy as far as ideas go. errors should not be normalized yet those relying on errors could tend to believe they are equals with those who do not. the difference is that the people whose ideas are based within truth, built upon its foundation, are capable of debating the ideas and having them challenged - for the strength of the ideas is their truth, and thus the logical reasoning of hypotheses and conceptualization of reality in this condition -- removed of known warping, skew, distortion -- is the way of strengthening the ideas, which become robust through their fitness for accurately modeling a situation, and they can withstand critique and can be altered and improved, which is the obligation. whereas those who do not allow 'their ideas' to be evaluated are weak-minded and have weak-ideas that cannot withstand critique and falsification is disallowed, and thus the viewpoint is made infallible-- and yet this ungrounded relativism may still assume an equality with truth that is vetted beyond its boundary. this is an act of egotism and a conceit and form of narcissism. such views can be entirely defeated, the minor truth salvaged, yet the false worldview itself collapsed and utterly abolished for the false perspective it is. and thus "debate" within a non-binary logical framework is the threshold for the accountability and testing of the limits of a given pseudo-truth POV. in that, when reasoned outside the binary viewpoint and not allowed to rely on ideological opinions and 'true beliefs', the ones and zeros of the ideas themselves and the arguments can be dismantled and the minor truth (1) can be separated from the majority falsity (0) including lies, deception, and bad faith of intellectual posturing, and thus what is shared is truth (1) yet what is unshared and differentiated is the opponents reliance on lies and falsehoods and manipulating this truth to a onesided agenda, and that cannot simply be erased or equated with a more pure and honest pursuit in service to truth and its vital role in developing civilization, including morally and ethically. versus its corruption, bringing about its demise. these are not equal agendas or equal goals- they are antagonistic relations and thus those who serve falsity are not the same as those who serve truth. those who surveill and oppress those in service to truth, however relative their viewpoint is legitimized, are essentially enemies and opponents of this truth and are not equals are observers, thinkers, or doers. if someone does not recognize truth beyond their limited viewpoint they cannot be reasoned with, the only reasoning they recognize is power itself as truth, in that power determines what is real, what is true, what is good, etc. so this is to make a distinction between those who 'believe' things without the need for external verification of these same beliefs, as different from those who require this as a necessary process of self-auditing and accounting. in this way, when someone is pointing a cellphone to monitor you on the street, and tallying such data, they operate in a particular framework that is oppressive to others in the society, and their actions are not invisible nor without consequence. it is not simply a mistake or misinterpretation, yet this would be the relativists argument, trying to retain a shared set evaluation as if in-group when actively and parasitically hostile. (whats next- electroshock dog collars and invisible fencing for bad citizens?)these people are scum. there are leagues of citizen surveillers sustaining the embubbled false reality that cellphones and monitoring apps allow, as if subconscious to the surveillers even, as if a dream-state, as if no one notices them pointing their cellphone at people walking by, data paparazzi for the evil dictatorial takeover, these cyborg and mindless zombie the latest ground troops of successive invasions, large populations of drones that are pointing and clicking their binary ideology into existence, they are not 'traditional' citizens nor constitutionally constrained in their activities. nor should they be defended by these parameters either, for involvement in illegal offensive operations and cattle chute coordination of citizenry mapped to the warped and SUPERSECRET "encrypted" masterplan. T =/= pT empirical truth =/= relativistic pseudo-truth grounded observation =/= ungrounded observation truth =/= partial truth + massive falsehood honesty =/= lies, distortions, onesidedness MEDIOCRITY IS TYRANNY ---- Scholars in Bondage Dogma dominates studies of kink http://chronicle.com/article/Scholars-in-Bondage/139251/ Paprika, Babette's Feast, Koyaanisqatsi ¿ ç ñ

1 0

The Great Firewall of Belgium
by Laurens Vets 12 Oct '13

12 Oct '13

Hello, The major ISPs of Belgium were forced to block certain sites starting in 2009. The list of blocked websites is secret (except for the gambling sites blocked due to regulatory issues with the Belgian gaming commission). The blocked sites can be categorized as: - websits containing child porn - child porn whistleblowing sites (long story) - Regulatory issues with the gaming commission (this list is public) - Piracy related (The Pirate Bay amongst others) - Webshops selling illegal medicine and other forbidden products I've been trying to uncover this list here: http://www.randomstuff.be/your-government-is-lying-to-you-and-something-abo… Basically, DNS requests for those websites are redirected to a government controlled webserver. What other techniques are there (besides checking every site on the internet) to try and uncover whether sites are blocked in Belgium? -Laurens

2 1

<nettime> Milton Mueller: Core Internet institutions abandon the US Government
by Eugen Leitl 12 Oct '13

12 Oct '13

----- Forwarded message from nettime's_roving_reporter <nettime(a)kein.org> ----- Date: Sat, 12 Oct 2013 23:53:37 -0100 From: nettime's_roving_reporter <nettime(a)kein.org> To: nettime-l(a)kein.org Subject: <nettime> Milton Mueller: Core Internet institutions abandon the US Government Reply-To: a moderated mailing list for net criticism <nettime-l(a)mail.kein.org> < http://www.internetgovernance.org/2013/10/11/the-core-internet-institutions… > The core Internet institutions abandon the US Government [Milton Mueller] October 11, 2013 In Montevideo, Uruguay this week, the Directors of all the major Internet organizations - ICANN, the Internet Engineering Task Force, the Internet Architecture Board, the World Wide Web Consortium, the Internet Society, all five of the regional Internet address registries - turned their back on the US government. With striking unanimity, the organizations that actually develop and administer Internet standards and resources initiated a break with 3 decades of U.S. dominance of Internet governance. [15]A statement released by this group called for "accelerating the globalization of ICANN and IANA functions, towards an environment in which all stakeholders, including all governments, participate on an equal footing." That part of the statement constituted an explicit rejection of the US Commerce Department's unilateral oversight of ICANN through the IANA contract. It also indirectly attacks the US unilateral approach to the Affirmation of Commitments, the pact between the US and ICANN which provides for periodic reviews of its activities by the GAC and other members of the ICANN community. (The Affirmation was conceived as an agreement between ICANN and the US exclusively - it would not have been difficult to allow other states to sign on as well.) 15. http://www.icann.org/en/news/announcements/announcement-07oct13-en.htm Underscoring the global significance and the determination of the group to have a global impact, the Montevideo statement was released in English, Spanish, French, Arabic, Russian and Chinese. In conversations with some of the participants of the Montevideo meeting, it became clear that they were thinking of new forms of multistakeholder oversight as a substitute for US oversight, although no detailed blueprint exists. But that was only the beginning. A day after the Montevideo declaration, the President and CEO of ICANN, Fadi Chehadi - the man vetted by the US government to lead its keystone Internet governance institution - met with Brazilian President Dilma Rousseff. And at this meeting, Chehade engaged in some audacious private Internet diplomacy. He asked "the president [of Brazil] to elevate her leadership to a new level, to ensure that we can all get together around a new model of governance in which all are equal." A press release from the Brazilian government said that President Rousseff [16]wanted the event to be held in April 2014 in Rio de Janeiro. The President of ICANN thus not only allied himself with a political figure who has been intensely critical of the US government and the NSA spying program, he conspired with her to convene a global meeting to begin forging a new system of Internet governance that would move beyond the old world of US hegemony. 16. http://www.news24.com/Technology/News/Brazil-to-host-internet-governance-su… Make no mistake about it: this is important. It is the latest, and one of the most significant manifestations of the fallout from the Snowden revelations about NSA spying on the global Internet. It's one thing when the government of Brazil, a longtime antagonist regarding the US role in Internet governance, gets indignant and makes threats because of the revelations. And of course, the gloating of representatives of the International Telecommunication Union could be expected. But this is different. Brazil's state is now allied with the spokespersons for all of the organically evolved Internet institutions, the representatives of the very "multi-stakeholder model" the US purports to defend. You know you've made a big mistake, a life-changing mistake, when even your own children abandon you en masse. Here at the Internet Governance Project we take only a grim satisfaction in this latest turn of events. We have been urging the USG to end its privileged role and complete the privatization of the DNS management for nearly ten years. The proper substitute for unilateral Commerce Department oversight, we argued, was not multilateral "political oversight" but[17] an international agreement articulating clear rules regarding what ICANN can and cannot do, an agreement that explicitly protects freedom of expression and other individual rights and liberal Internet governance principles. We have heard every argument imaginable about why this did not have to happen: no one really cared about the governance of the DNS root; there was no better alternative; the rest of the world secretly wanted the US to do this; etc., etc. A combination of arrogance, complacency and domestic political pressure prevented any action. 17. http://www.internetgovernance.org/2009/06/08/igp-calls-for-us-led-internati… Had that advice been heeded, had the US sought to divest itself of its unilateral oversight on its own initiative, it could have exercised some control over the transition and advanced its cherished values of freedom and democracy. It could have ensured, for example, that an independent ICANN was subject to clear limits on its authority and to new forms of accountability, which it badly needs. Now the U.S. has lost the initiative, irretrievably. The future evolution of Internet # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] naive suggestion: conform to US laws
by Eugen Leitl 12 Oct '13

12 Oct '13

----- Forwarded message from Jim Thompson <jim(a)netgate.com> ----- Date: Sat, 12 Oct 2013 16:36:47 -0500 From: Jim Thompson <jim(a)netgate.com> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] naive suggestion: conform to US laws Message-Id: <9BD42070-7086-41C6-8E52-C5DB49C500ED(a)netgate.com> X-Mailer: Apple Mail (2.1812) Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> On Oct 12, 2013, at 1:35 PM, Chris L <cjl(a)viptalk.net> wrote: > >> On 2013-10-12 01:40, Jim Thompson wrote: >>> >>> I'm not willing to endure this uninformed Alex Jonesian crapfest. > > Nice position to take, except Alex Jones was right. Sigh. As much as this doesn’t belong on the pfsense list… I actually know Alex, or did, 13 year ago. I got friendly enough with him back in the mid-late 90s that we had each other’s cell phone numbers. Back then Jamie and I were involved with Fringeware. http://en.wikipedia.org/wiki/FringeWare_Review http://www.austinchronicle.com/issues/vol16/issue26/screens.fringeware.html Fringeware became an advertiser on Alex Jones' radio show (on KLBJ, before he got booted). On the front-end, I was a respected advertiser. Meanwhile, others associated with Fringeware were culture-jamming him on the back-end. the result: #discordia Oh, the memories this brings back. (As you’ll see, the FBI showed up to demand something, didn’t have a warrant, and was shown the sidewalk.) http://www.wingtv.net/thorn2006/jarhead.html http://www.austinchronicle.com/news/2000-07-14/77932/ Clayton, btw is a dear friend. Easily one of the most brilliant people I’ve ever known. I hope he speaks at my funeral. Other fun was had at Fringeware. We supported the Yes Men (http://en.wikipedia.org/wiki/The_Yes_Men) We actually hosted their website, as well as that of RTmark for a period in the late 90s on the same machine used for smallworks.com (which was originally the corporation behind the firewall named “Netgate”), fringeware.com, etc. One of their pranks was that they setup a website named www.gwbush.com. (http://en.wikipedia.org/wiki/The_Yes_Men#George_W._Bush http://theyesmen.org/hijinks/gwbush http://www.rtmark.com/bush.html) which resulted in Bush’s famous "There ought to be limits to freedom,” quote. http://www.rtmark.com/bushpr2.html The great untold story on this is that all these websites were hosted in a shitty office building on Shoal Creek Blvd, one floor up from the then offices of "Karl Rove & Associates” even as they fought to shutdown gwbush.com. The #irony was delicious, and they never succeeded. :-) Anyway, you might want to study up on STRATFOR, or Mary Maroney, who was the editor and chief of Infowars magazine until earlier this year. Maroney formerly worked for Stratfor and Parker Media here in Austin. If you don’t know who they are, then I suggest more research on your part. Have fun, but be careful when you enter the rabbit hole. Snowden and Manning are both late-comers to the party: http://www.newyorker.com/reporting/2011/05/23/110523fa_fact_mayer?currentPa… http://www.technologyreview.com/news/519661/nsas-own-hardware-backdoors-may… http://cryptome.org/nsa-ssl-email.htm http://news.cnet.com/8301-31921_3-20017671-281.html http://www.wired.com/images_blogs/threatlevel/2013/09/15-shumow.pdf (see also: http://www.wired.com/threatlevel/?p=85661) http://arstechnica.com/security/2013/01/secret-backdoors-found-in-firewall-… http://dl.packetstormsecurity.net/papers/general/my_research1.pdf http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.154.825 / http://www.cs.ucf.edu/~czou/research/Chipset%20Backdoor-AsiaCCS09.pdf (now consider all the cheerleading for Intel Ethernet chips on the various pfSense lists…) Jim _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] Whonix Anonymous Operating System Version 7 Released!
by Eugen Leitl 12 Oct '13

12 Oct '13

----- Forwarded message from adrelanos <adrelanos(a)riseup.net> ----- Date: Sat, 12 Oct 2013 18:53:38 +0000 From: adrelanos <adrelanos(a)riseup.net> To: liberationtech <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] Whonix Anonymous Operating System Version 7 Released! Message-ID: <52599AB2.5070305(a)riseup.net> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network, Debian GNU/Linux and the principle of security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible. Download: https://www.whonix.org/wiki/Download Users of Whonix 0.5.6 and below: There is no upgrade path from Whonix 0.5.6 to Whonix 7. You have to manually download new Whonix images. Call for Help: If you know shell scripting (/bin/bash) and linux sysadmin, please join us! There are plenty of ways to make Whonix safer. We are also looking for an https direct download mirror. Whonix 7 Changelog: * Updated Tor to 0.2.4. * Installed obfs3 by default. (for obfsproxy bridges) * New Identity button on Tor Browser is now functional thanks to the Control Port Filter Proxy (#3). * Tor Browser is now the system default browser (#86). In addition, when opening a link or an html file it will ask for confirmation to avoid accidental linking. (configurable) * Graphical Whonix-Gateway (#26). Optionally, if you reduce Whonix-Gateway RAM to below 500 MB, let's say to 128 MB, you automagically end up with the usual non-graphical Whonix-Gateway. (configurable) * Whonix now includes an updater. It can not be promised that you will never have to download a new image for next stable releases, but we are on that way. Interested testers may have to download images of testing releases from time to time. * Tor networking is disabled for the first start of Whonix-Gateway. The connection wizard (whonixsetup) will automatically start to help enabling Tor or setting up bridges. This is useful for people using bridges to connect to the Tor network to hide the fact that they are using Tor. * The current Tor Browser Bundle (TBB) Alpha, which will soon become the new TBB stable, will work out of the box in Whonix, even if you download and install it manually from torproject.org. This is useful for the case that the Whonix Tor Browser updater breaks due to changes on torproject.org. Tor over Tor situation will be automatically prevented on manual installs. * Boot Clock Randomization. * Time Sanity Check. * Higher console resolution: 1024x768 (without X). * Disabled the throw-keyids option on gpg.conf due to usability issues. Enable it manually if you need it. * Fixed uwt. To do certain tasks such as installing the Adobe Flash plugin or running update-command-not-found you no longer need to "chmod -x /usr/local/bin/curl". * Deactivated the kgpg tray icon by default (#10), not perfect, but less confusing, since it will now start in foreground by default and no longer as tray icon (which was automatically and confusingly hidden by default). * Downloading Tor Browser and signature from idnxcnkne4qt76tg.onion instead of torproject.org for better security when run inside Whonix. * Time Privacy wrapper (optional). * Enable "apparmor=1 security=apparmor" by default (didn't enable enforce mode or add any useful profiles yet). * Manpages for scripts which come with Whonix. * Flexible modular .d style configuration folders: /etc/whonix.d/, /etc/whonix_firewall.d/, /etc/controlportfilt.d/. * Moved blog to wordpress.com, better than sourceforge, because wordpress.com supports SSL, closed #23. * Lots of other improvements and bug fixes which can be found under the git log. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJSWZqwAAoJEJwTGtNxOq7vH9YP/jwBuyMyFZ4hP9AMgPHjMTHG uxYRy7mHzJIum9goghWrAgYTys3oGyHDSMTuhErcJ+bEV4jb2WAqifUa+iId8rs/ 6HeHfssctY7fHoxbaKbapMlCJ6JN0pU23RtsWsZcn5jXaldmtVHMlS4PWMuU56Mh oSuH2cw6KvsKo/QO3F7xVnYy4VNX28oEeF3dWf4keZN8Sr+Nezlci0nPYYuHCNv/ DUwv1kpSW5B5+Ki5xJW9CgiGeOtw7kwL2w4gbcI7yAywEWytCkVeDHCF/sHdqYf/ PcCpQ23FQmRBB3MKLNF1qr47uj1ninbM+EPLtZQV9vVx3Qpgcv9mnMEV2zu1/geu ydjXMZv+v3UmFvG//Uttciga7Dk4XXpY8HKglS0YkRY0E7KLOkdRvO2Y2G57EQMC Pp2UoSWv43gBtoeKNIJXwjrm7UDPvhB6UHavORIB7feeBI4ke0FN6vJ81jpwUvIm PV2yBXfBguByZvG2oRUbQbgKFcg/OfD+ydOG+SJwcqNops28VjJ7qcgsUFb4vk/m v83DzogQOB0Wz0iWBlZkBTH8OI7+HebX+ocrLuGQif9z2OHGQ2UzeKgFlg97gj6N l2rD0JWHbqPhXvLKJIzNZAWN9QAuIo0QCPPcpBWKvlaQTKalxnFsm7Gz4Pg5eSdZ cgSrquvrMEOLlNGRagZ9 =nyvS -----END PGP SIGNATURE----- -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

who are the service operators here?
by Joseph Holsten 12 Oct '13

12 Oct '13

I'm currently working on both chef cookbooks and dockerfiles for a bunch of old services I used to run in the good old days (pre 2000) of cypherpunks. Boring stuff like qmail, tinydns, pgp keyserver. But I'm dying to know what fancy new services people are operating these days. Any distributed chat ops? Blob/file storage? Remailers? Bitcoin pools? In another vein, what ops do you think a self-sufficient punk ought to be running? I'm thinking I absolutely need: - Tor endpoint - vpn endpoint (openvpn?) - smtp/imap sever (what's modern?{ - file/blob server (tahoe-lafs, camlistore?) - jabber server (ejabberd?) (Yes, my homepage is showing a ruby script. No, I don't have time to fix it in situ. Thus setting up my own servers) -- ~j

8 10

Re: [Freedombox-discuss] Which mesh system should be included in the Freedombox?
by Eugen Leitl 12 Oct '13

12 Oct '13

----- Forwarded message from Paul Gardner-Stephen <paul(a)servalproject.org> ----- Date: Sat, 12 Oct 2013 20:23:27 +1030 From: Paul Gardner-Stephen <paul(a)servalproject.org> To: Petter Reinholdtsen <pere(a)hungry.com> Cc: freedombox-discuss <freedombox-discuss(a)lists.alioth.debian.org> Subject: Re: [Freedombox-discuss] Which mesh system should be included in the Freedombox? Message-ID: <CA+_T8-C5m-2+1snwQZpz4GUdHinqy1z19ixnuk=we6px3ghEiQ(a)mail.gmail.com> Hello all, On Sat, Oct 12, 2013 at 6:06 PM, Petter Reinholdtsen <pere(a)hungry.com>wrote: > > [Sandy Harris] > > As I see it, security has to be the first consideration for any Box > > component, including a mesh system. Given the stated project goals we > > should not even consider anything unless we have good reason to > > consider it secure. > > Well, I believe that is putting the cart in front of the horse, given > the current amount of people involved. I believe we first need to get > something useful that can be located in the privacy of the users homes > to get that legal protection, and then we can continue improving that to > make it more and more "secure", which is a word that mean different > things to different people and thus hard to have as a fuzzy goal. > > This mean to me that we pick solutions already in common use and > integrate it into the Freedombox, and depend on the rest of the free > software community to audit it (with our help, if someone in the > Freedombox want to spend time on it). > > > If something looks desirable but has not had an audit for security, > > then auditing it and contributing fixes if needed is more important > > for the Box than things like getting it into Debian or making it run > > on a Dreamplug. > > I am happy to hear that you want to focus on that area, and suggest you > have a look at the batman-adv mesh routing system when you find time to > audit mesh systems. > > I've concluded I will focus on batman-adv for now, as it provide layer 2 > mesh networking (as in both IPv4 and IPv6 will work) and is used by the > Serval project that provide a peer-to-peer phone system that allow phone > calls and "SMS" messaging without central infrastucture. If the > freedombox provide mesh nodes compatible with the Serval project, we get > free software phone support for free. :) > So some clarification here: Serval used to use the original layer-3 batman, and can still coexist with batman, batman-adv, babel, olsrd etc. But Serval now includes its own mesh routing protocol, for many of the reasons that are stimulating discussion here. Some of those reasons include the difficulty of making a secure fully distributed network, especially a mesh network. Indeed, this was a major reason for us side-stepping IP, and creating our own mesh-oriented network layer. We started from the ground-up by using public cryptography keys as network addresses. This means that we promiscuously share and exchange public keys on the network as part of its inherent operation. It also means that end-to-end encryption is trivial, requires no key exchange, centralised authority or other complication. Indeed, encryption is so simple in the Serval network layer that we enable it by default: you need to set flags on a packet if you don't want it signed and encrypted. Careful choice of crypto system means that it is still fast, and doesn't need huge keys. We also added an address abbreviation scheme that means that we typically have smaller network headers than IPv4, let alone IPv6. That leaves only key verification to ensure private man-in-the-middle-free communications with any party on the network -- a problem that the open-source community has largely solved with web of trust. This security platform was recently recognised at the Global Security Challenge grand-final in London where we received an Honourable Mention, coming a close second in the entire competition -- against entrants from the USA, UK, Israel and other major players in the security space. We do not rest on our laurels, nor do we take the praise of men as meaning that we have a perfect or vulnerability-free system. But we do believe that we have created something that has great potential in the open-source world, and especially for projects like Freedom Box where private correspondence (text, voice and data) on a fully-distributed self-organising network is a major objective. As mentioned, because all Serval services operate in parallel to IP, this means you can mix and match Serval service with your favourite traditional mesh routing protocols should you wish to use them. It also means that we can use interesting radio platforms that are too slow to be useful on IP, e.g., ~100kbit/sec ISM band radios that have ranges 10x to 100x that of Wi-Fi. We already have a working example of this in our Serval Mesh Extender hardware device, which also shares many common objectives with the Freedom Box. We think that we have some interesting technologies that are of use to this community, and of course since we develop them as free and open-source software, we encourage this community to take whatever they find useful, and perhaps even open a conversation for us to work out what activities and efforts are in the intersection of our needs and objectives, and apply some combined energy that will accelerate our mutual progress towards our goals. Paul. > See my blog post from yesterday, > <URL: > http://people.skolelinux.org/pere/blog/Oslo_community_mesh_network___with_N… > >, > for more details of what I have found out so far. > > -- > Happy hacking > Petter Reinholdtsen > > _______________________________________________ > Freedombox-discuss mailing list > Freedombox-discuss(a)lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss > _______________________________________________ Freedombox-discuss mailing list Freedombox-discuss(a)lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] naive suggestion: conform to US laws
by Eugen Leitl 12 Oct '13

12 Oct '13

----- Forwarded message from Jim Thompson <jim(a)netgate.com> ----- Date: Sat, 12 Oct 2013 11:59:33 -0500 From: Jim Thompson <jim(a)netgate.com> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] naive suggestion: conform to US laws Message-Id: <9D8BFE6E-48A9-42E2-A494-99892FA27C90(a)netgate.com> X-Mailer: Apple Mail (2.1812) Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> On Oct 12, 2013, at 7:20 AM, Thinker Rix <thinkerix(a)rocketmail.com> wrote: > On 2013-10-11 22:33, Walter Parker wrote: >> Yes, you have been informed correctly. There are more than 2. According the World Atlas (http://www.worldatlas.com/nations.htm#.UlhOHVFDsnY) the number is someone between 189 and 196. > > No kidding! ;-) > >> But you did not answer the question asked: Name the country that you would move the project to and why you believe that country would do a better job? > > Why should *I* name it and why should I present ready solutions for an idea another community member brought up? Why should anybody be in a position to present ready solutions at this point? How about having a fruitful discussion and find solutions together? There is no reason to build a house on sand. There is no fruitful discussion to be had when the premise is patently false. >> Then because the USA can't be trusted, who is going to replace the Americans on the project? > > You are mixing things up here. Just because the USA invented their tyrannous "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act", for which they perversely coined the euphemistic term "Patriot Act" and there fore can not be trusted anymore for hosting anything there, why should the Americans be replaced?!?!? > >> The name and logo are owned by an American company. > > I guess, that is true, i.e. that ESF registered pfSense and it's log as a brand name. You seem upset at this. Why? Instead of some kooky conspiracy theory that ESF could be tortured or pressured to weaken pfSense, is this the *real* issue you have? >> I doubt they want to give them up to a foreign company owned by non-Americans > > Nobody suggested that. Try thinking a bit more outside the box! > For instance: A non-profit foundation could be founded in a country outside the USA, and the brand, hosting of the project, etc. be transferred to that company. A board would be elected for this foundation who just a few basic things annually to keep the foundation running. > ESF on the other side would be released of a great threat! They could continue offering their pfSense services to their customers as usual, but from now on nobody could come and force them to do things to pfSense since "they have nothing to do with it”. You seem upset that ESF controls the project. Why? >> just to make it harder for the American government to pressure the project. > > Incorporating pfSense and bringing it out of the reach of US-domestic jurisdiction would not "make it harder" but "impossible" to pressure the project. You have provided no explanation (other than “rubber hoses”) for what form that “pressure” would take. >> If the rest of world wants to fork the project because of concerns about the US government, fine, but I don't think you will get buy in from ESF [the American company that owns the rights to the name pfSense]. > > Why to fork the code base?! No one suggested that - and no one suggested to do things without - or even against - the key people of the ESF. Right the opposite. It would even protect the ESF! > >> Once again, name some names. Who do you consider more trustworthy? > > I am not Jesus to hand solutions to the community on a silver platter though point in fact, Jesus didn’t hand anyone a solution. > (but surely would be available for a *constructive* and *well-disposed*, *amicable* discussion to find solutions together!). I know of quite a lot of countries that seem interesting for a closer analysis for this cause and surely would propose one or another in such a constructive discussion. > > Generally, what Adrian proposed makes only sense, if the community - including ESF - understands the threat and decides to act proactively to fight this threat. “The community” doesn’t own the copyright on the code, nor the trademarks to the names used. Those belong to ESF. Further, you’ve hypothesized about a ‘threat’ without providing any factual basis for same. The term for this form of argument is “conspiracy theory”. Since pfSense is open source (specifically, the BSD license), “the community” (or rather “a community”) could take the decision to fork the code and create their own solution. It’s been attempted a couple times, but none of these have flourished. While I don’t encourage forks (it’s typically not good for either project), occasionally they work out (at least for a while), I don’t go out of my way to inhibit those who wish to fork. However, in any case, such a community would be prohibited from naming the result “pfSense”. > But since 33% of the ESF - namely Jim Thompson You greatly inflate my ownership interest here. > - prefers bullying, insulting, frightening and muzzling anybody who brings up the threat that we are facing, trying to strike dead any thought as soon as it comes up (strange, isn't it?), Not as strange as someone randomly showing up one day, hiding under a pseudonym, having never posted to a pfSense list before, making accusations. You started throwing accusations, and yes, I got hostile. Mostly I got hostile because your accusations are baseless, and despite my challenge, you refuse to drop it. Since your activities are not furthering the project (find bugs, or at least make proposals), you’re wasting everyone’s time. (I’d quote Spock here, but…) Goodness man, you don’t even understand what happened with Lavabit, or why the situation would be different if a three letter agency were to show up on the doorstep one morning and demand that we weaken the project. Despite my challenges (“name the law that they would use”), you refuse to respond, instead ducking for cover in your empty, baseless accusations that “it might happen”. Specifically, Lavabit ran afoul of the Stored Communications Act (http://en.wikipedia.org/wiki/Stored_Communications_Act) "a law that addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party internet service providers (ISPs)." ESF is not an ISP. The SCA does not apply. CALEA (http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_…) obliges telecommunications companies to make it possible for law enforcement agencies to tap any phone conversations carried out over its networks, as well as making call detail records available. Common carriers, facilities-based broadband Internet access providers, and providers of interconnected Voice over Internet Protocol (VoIP) service – all three types of entities are defined to be “telecommunications carriers” and must meet the requirements of CALEA. Since ESF is not a “telecommunications carrier”, CALEA does not apply to your proposed “FBI/NSA on the doorstep” scenario. Even the various provisions of the PATRIOT act of 2001 (and it’s follow-ons) do not apply. The most abusive of these, the so called “NSLs” are really a demand letter issued to a particular entity or organization to turn over various records and data pertaining to individuals, and an accompanying "gag order". Since pfSense has no reason to store any records, there is nothing to hand over. You could *perhaps* make the case that the config backup service could be attacked this way, but it was specifically designed such that ESF (or before January, BSDP) doesn’t have access to the plaintext configuration. It is encrypted by the remote user, and we store the result. We don’t know the keys. Thus, my challenge stands. You have yet to offer ANY legal authority under which the NSA (or any other agency of the US government) could demand that ESF make changes to pfSense. Some here in the “community” seem upset that I’ve been so abrasive with you. If you had an actual argument that made sense, you and they would see a different side (“Oh, you’re right. We should find a way to close that loophole.”) Instead, you stood on your accusations, despite any factual basis. Your "Culture of fear” argument was roughly equivalent to the meme of a couple years ago: "Did Glenn Beck Rape And Murder A Young Girl In 1990?” This hoax began as a parody of public perception of Glenn Beck’s over-the-top interview antics on his self-titled television show Glenn Beck, wherein he frequently asks his guests to disprove highly speculative and often outrageous assertions. (Just like you did.) About.com published an article titled “Internet Hoax Says Glenn Beck Raped, Murdered Young Girl in 1990”, which called the hoax a textbook example of “…how to construct Internet smear campaigns…” (http://urbanlegends.about.com/b/2009/09/03/internet-hoax-says-glenn-beck-ra…) So yes, I went after you, because the correct response here is to not let the attempt at a smear campaign stand. People love to take silence as assent. Placating you would have been a mistake of the first order. In the past, I’ve stood up to AT&T. It took a decade, and was both expensive and exhausting. I won. Fnord. You and those in the community who are upset with my behavior (whilst I was defending ESF and pfSense from your smear tactics) can bet their last Euro/Dollar/Yen that I’ll be 10X more abrasive with the US Government if they attempted what you accuse. Were I to seek a country that was at least outwardly opposed to the behavior of the US security apparatus (and its related apparatus in other countries), I might consider Brazil. That time is not now. What you probably don’t appreciate is that the actual “we write code before breakfast” people employed by ESF to work on pfSense are already outside the US(*). One of them lives in Brazil, another in Albania. Perhaps of interest. Perhaps not. At the very least, they’re not subject to US law, so it would be difficult to get them to “go quiet” about any attempt to weaken the codebase of pfSense. Jim (*) Jim Pingle does some, but not as much as the others. He does, however, carry most of the support load. _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0