- cypherpunks - lists.cpunks.org

Building Global Community - Mark Zuckerberg
by Cecilia Tanaka 05 Mar '17

05 Mar '17

*Building Global Community - Mark Zuckerberg* https://www.facebook.com/notes/mark-zuckerberg/building-global-community/10… No, I am not giving my support, nor criticizing this post. Yep, obviously I loved the message, but I don't trust the sender. There's something strange screaming "It's A Trap!" very loud, guys. :-/ https://youtu.be/4F4qzPbcFiA There are lots of stories on Internet saying that Zuckerberg wants to be a presidential candidate in the next elections. He said is not an Atheist anymore very recently and, well, everybody knows that the USA will never elect an Atheist... :P http://www.telegraph.co.uk/technology/2017/01/03/mark-zuckerberg-reveals-no… I respect a lot Atheist people, but I also respect a lot who believes in God, Godesses, Prophets, Deities, etc, etc... Mirimir is my imaginary friend and I almost married under the blessings of the Flying Spaghetti Monster (it's serious, one of my best friends is a wise Pastafarian "Minister"!), so I can't complain about the other persons' imaginary friends. I just don't like religions and their eternal judgements... The FSM is very tolerant! :P ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

4 8

Re: [tor-talk] Tor Project Corporate Document FOI Request
by grarpamp 05 Mar '17

05 Mar '17

On 8/8/16, Ken Cline <cline(a)frii.com> wrote: > "various Licenses and Certificates held" A corporation can be issued, issue, and hold, various licences and certs, be they from or to, private or public entities, governments, or persons. Could be... vendor / reseller, awards, permission to bid / let [govt or other] contracts, provide services, etc. Use your imagination. TPI knows what it does or doesn't hold. And TPI can be transparent by listing them all proactively instead of requiring community go on phishing expedition for them by name. > "form blanks to be signed by new parties of all types" TPI has surely asked folks to fill out or sign, and been asked itself, regarding NDA's / [de]briefings, pre / during / post employment blanks, template blanket MOU's, etc. Use your imagination. TPI operates a corporate "office", a corporate office has form blanks for all sorts of uses. In particular when liasing with or initiating new parties of all types. As with the "new docs" someone posted for the future, folks are interested in seeing any similar docs applicable to the past. Only TPI knows what they were named. Those of employment and [process] acknowledgement are certainly higher than stupid petty cash and phone memo forms, come on now :) > [http://corp.sec.state.ma.us/corpweb/CorpSearch/CorpSearch.aspx] > "Articles Of Incorporation", "Charter", "Bylaws", and "Operating Agreement". > Except for Bylaws, these named documents do not exist. No, the state mandated Articles and Annuals exist there. NO!, the bylaws (another name for operating agreement), a highly relavant thing for transparency, do not seem to exist anywhere. Whatever other major structural and procedural docs may exist, who knows. Those are just some of the common names for them. Other people can add other names. Worth nothing is that whether or not any doc is [required to be] filed with government agencies, and whether or not it is publicly available from them once filed... is different from what TPI may choose to publish on its own for the community. > You will find their > Articles of Organization and Annual Reports, which contain relevant > information. Regardless, whatever is publicly available or FOIA-able on a government site should also be posted for transparency on TPI as well. > Others are on the Tor Web site itself: > ("List of Officeholders", "Executives", It's not necessarily clear, in a classically hierarchical org chart sort of way, who held all the various high titles and when. > "Voting Members" NO!, voting and election does not appear to be detailed at all anywhere. Only opaque references to "duly elected" and "adopted". And "member" often means certain things in corporate law as well. > Of course, there are no shareholders While "non-profit" (its own curiosity to be sure), may hold certain meaning and requirements in certain jurisdictions, the extension of that to concepts of founding / holding parties and redistribution, optionally to achieve "non-profit", may be different. Links to law refs on the topic could be useful for those that didn't already notice a reference to the possibility of that in the Articles (under powers). > precisely which people have voting power will be > detailed in the Articles of Organization or Bylaws. Pointless when the AOI says nothing there, and the bylaws aren't available. Nor can community be expected to wade through MA/US law to see if any particular "Officer" or "Director" is granted unwaivable voting rights under law. > Still others appear not yet available. Yes. > patience in obtaining the audited 2015 financials. If TPI's release of particular docs is governed by requirement of law, that's different. But if community can FOIA same from govt, there is no such requirement, and TPI should transparently publish. > "Meeting Minutes covering years 2010 ~ 2015" should be available. > I would contact the Tor Project directly (Executive Director's office, > maybe). No user, donor, or interested party should be pushed / required to go private fora like that. It's their right to ask in public, to do so by proxy person or tor etc, and to retain their motivations. And whatever TPI does with such requests is up to TPI. If it's transparent with servicable open fora, it's a non issue. It's also silly to be fielding multiple same requests when a single transparent proactive publication of same will serve everyone. Yes, minutes are very important for transparency. It's extremely unlikely the ED's office did not know, or was not informed, within no more than a few days of the request, probably more like a few hours. Certainly not a few weeks. > The issue you > filed in the tracking system was given medium priority, which seems proper Few could have problem with that. As before, only with lack of ack and general plan of reply. > your request It should not be considered mine, but a presentment of some community voices / ideas / tasks gone forgotten / unattended over time, into a more prominent and useful form. And with recent events pressing... journalists could easily be added to list of supporting and interested parties. Others are welcome to carry the request forward.

1 1

Re: [Cryptography] Text of Burr-Feinstein encryption backdoor bill
by grarpamp 05 Mar '17

05 Mar '17

> https://assets.documentcloud.org/documents/2797124/Burr-Feinstein-Encryptio… > https://www.burr.senate.gov/imo/media/doc/BAG16460.pdf Lawmaking, Crypto, and Weasel Words... One Random Read Between The Lines > A BILL > To require [crap] > and for other purposes Because "other purposes" is how you sneak in more unwanted crap behind the first crap. And how you avoid legitimate up or down on any single issue. Feature creep 101. > "Compliance with Court Orders Act of 2016" Sounds dreamy and routine doesn't it, just breeze over it on a lazy Sunday in the park and vote yes on Monday. Nothing to see here, move along. > It is the sense of Congress that ... These weasel words are particularly revolting, they smell like flowers but they're not. They vote for them because flowers... after all, their expected "sense" and thus their expected vote has already been printed on paper for them by their leaders, how could they ever vote against such pretty things. After gleefully voting for it, they then find themselves forever trapped because this "sense" has now been formally imposed upon their prior independance by law. Any dissent against the enacted flowers now becomes an embarrassing politically suicidal case of position changing, and illegal, because it's not following the official "sense". Disgusting. > (1) no person or entity is above the law Actually, they are, at least until the law exerts itself over special selectees among them, typically reserved for dissenters. > (2) economic growth prosperity security, stability, > and liberty require adherence to the rule of law Actually, none of these *require* any law, let alone blind adherance to it. > (3) the Constitution and laws of the United States > provide for the safety, security, and civil > liberties of all United States persons No, they don't, nor are there any such guarantees. > and the > protections and obligations of these laws apply to > all persons within United States jurisdiction No, they don't. Notice the routine trotting out of grand patriotic bullshit like this to dispel any critical thought and bank votes on shit laws. PATRIOT even had it in its title. > (4) all providers of communications services and > products (including software) "Software"... see, they snuck in the all encompassing grandaddy of them all... any / all / your "software", including opensource and private use, and extends to hardware as software in silicon. > should protect the > privacy of United States persons through implementation > of appropriate data security Stage setting under dissentproof "sense of congress" for future legislated "security". Lots of failure there. See also: CALEA Everywhere, plugin goatse version > and still respect the rule > of law and comply with all legal requirements and court > orders Attempt at washing away dissent, disrespect and noncompliance as unconscionable / evil acts, or unacceptable to even think of. > (5) to uphold both the rule of law and protect > the interests and security of the United States, Wait a minute, thought this US thing was about "we the people", now it's only about "of the United States" itself? > all persons receiving an authorized judicial order Wait a minute, judges issue their own independant orders, all the way up to the Supreme's, so now just exactly *who* is doing this "authorizing" above them? You don't think the Judicial Branch will just lay themselves over entirely to statutory law do you? Alternatively, just what is the police force of the Judiciary, and who does it report to? > for > information or data must provide, in a timely manner, > responsive, intelligible information or data, or > appropriate technical assistance to obtain such > information or data These days, thanks to your allowing them twisting it for 15+ years, "technical assistance" now includes indefinite detention and rubberhose "tech"niques, destruction of family / work life, asset forfeiture, etc. Also, tricking and ratting out others is hip. > (6) covered entities must provide responsive, > intelligible information or data, or appropriate > technical assistance to a government pursuant to a court order. All "entities" to any "a government" around the world? Nice one. Global Order [?] brought within a Sea of Pretty Flowers. Proudly passed by your Presidents and Congresses, stamped by Judges picked by same. People around the world need to be reading the crap that gets put in their laws, then getting rid of the crap that put it there.

2 1

Fwd: [Cryptography] Uber "Greyball"-ed city authorities w/fake screens
by grarpamp 05 Mar '17

05 Mar '17

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Fri, Mar 3, 2017 at 6:53 PM Subject: [Cryptography] Uber "Greyball"-ed city authorities w/fake screens To: cryptography(a)metzdowd.com FYI -- https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-a… 'To build a case against the company, officers ... posed as riders, opening the Uber app' 'Uber had tagged [the officer] ... based on data collected from [his/her] app ... The company then served up a fake version of the app populated with ghost cars' 'When Uber moved into a new city, [an Uber employee] ... would try to spot enforcement officers. One technique involved drawing a digital perimeter, or "geofence," around the government offices ... people were frequently opening and closing the app ... near such locations as evidence that [they] might be associated with city agencies. Other techniques included ... credit card information and determining whether the card was tied directly to an institution like a police credit union.' http://www.cultofmac.com/304401/ubers-android-app-literally-malware/ Uber's data-sucking Android app is dangerously close to malware [updated] By Buster Hein -- 11:22 am, November 26, 2014 Uber has been sideswiped by a ridiculous number of controversies lately, but things are about to get even worse for the ride-sharing service. A security researcher just reverse-engineered the code of Uber's Android app and made a startling discovery: It's "literally malware." Digging into the app's code, GironSec (http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/) discovered the Uber app "calls home" and sends data back to Uber. This isn't typical app data, though. Uber has access to users' entire SMSLog even though the app never requests permission. It also accesses call history, Wi-Fi connections used, GPS locations and every type of device ID possible. The app even checks your neighbor's Wi-Fi and retrieves info on the router's capabilities, frequency and SSID. News of the app's vulnerability was first posted on Hacker News with the charming intro, "TLDR: Uber's Android app is literally malware." (https://news.ycombinator.com/item?id=8660336) One developer commenting on the revelation said there isn't "any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it. There should probably be legal action." Here's the full list of all the data Uber is collecting through its Android app (we're checking to see if the iOS version works the same way): -- Accounts log (Email) -- App Activity (Name, PackageName, Process Number of activity, Processed id) -- App Data Usage (Cache size, code size, data size, name, package name) -- App Install (installed at, name, package name, unknown sources enabled, version code, version name) -- Battery (health, level, plugged, present, scale, status, technology, temperature, voltage) -- Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, IP, MAC address, manufacturer, model, OS platform, product, SDK code, total disk space, unknown sources enabled) -- GPS (accuracy, altitude, latitude, longitude, provider, speed) -- MMS (from number, MMS at, MMS type, service number, to number) -- NetData (bytes received, bytes sent, connection type, interface type) -- PhoneCall (call duration, called at, from number, phone call type, to number) -- SMS (from number, service number, SMS at, SMS type, to number) -- TelephonyInfo (cell tower ID, cell tower latitude, cell tower longitude, IMEI, ISO country code, local area code, MEID, mobile country code, mobile network code, network name, network type, phone type, SIM serial number, SIM state, subscriber ID) -- WifiConnection (BSSID, IP, linkspeed, MAC addr, network ID, RSSI, SSID) -- WifiNeighbors (BSSID, capabilities, frequency, level, SSID) -- Root Check (root status code, root status reason code, root version, sig file version) -- Malware Info (algorithm confidence, app list, found malware, malware SDK version, package list, reason code, service list, sigfile version) Uber might have a legitimate reason to use most of this info in the app, perhaps for fraud detection or an intelligence-gathering tool. The problem is that the information is being sent and collected by Uber's servers without users' knowledge or permission. Sen. Al Franken sent a letter to Uber CEO Travis Kalanick last week demanding the company account to the public for its data gathering. The letter came as a response to a recent controversy where an Uber executive threatened to spy on and blackmail journalists who wrote unfavorable articles about the company. Uber's "God View" tool, which gives company insiders unlimited access to riders' data, has also been a cause of concern in recent weeks. Cult of Mac asked Uber for comment on the collection and transmission of the data its Android and iOS apps are performing, but haven't received a response. Update: Uber has provided some clarification to the company's data gathering, noting that the blanket access is actually a requirement from Google, which forces Android developers to ask for privacy permissions up front. Uber spokeswoman Lara Sasken released the following statement to Cult of Mac: "Access to permissions including Wifi networks and camera are included so that users can experience full functionality of the Uber app. This is not unique to Uber, and downloading the Uber app is of course optional." Recode notes that Uber-competitor Lyft requests access to the same data on Android. Unlike iOS and Windows, Android developers are encouraged to request access to more user data than their apps actually need. The Uber app on Android exposes some the mobile operating system's weakness in privacy compared to iOS and Windows, both of which allow users to refuse access to data on an case-by-case basis. Additional information on Android permissions can be found on Uber's site here (https://m.uber.com/android-permissions) but not every feature is explained. ----- This article about the Ubar app as malware is several years old, but today's NYTimes article "How Uber Used Secret Greyball Tool to Deceive Authorities Worldwide" explains for the first time one of the real reasons for Uber's prurient interest in its users' data. Now that we know these reasons for Uber's spying, it becomes clear what information collected by Uber's app could be used to track authorities who are trying to catch Uber drivers in illegal activities. Uber's bloated app size (215MBytes on iOS -- probably required for all the fake screens, ghost cars, etc.) can be seen as an all-out assault on every one of its user's privacy. This NYTimes article also explains why Uber wants so desperately to spy on its users *all* the time (http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app… -- "Uber wants to track your location even when you're not using the app") -- not just when these users are utilizing Uber cars! _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

"802.eleventy what? A deep dive into why Wi-Fi kind of sucks"
by Razer 05 Mar '17

05 Mar '17

Semi-technical history and discussion (all technical terminology linked): > > > When wireless networking based around the 802.11b standard first hit > consumer markets in the late nineties, it looked pretty good on paper. > Promising "11 Mbps" compared to original wired Ethernet's 10 Mbps, a > reasonable person might have thought 802.11b was actually faster than > 10Mbps wired Ethernet connections. It was a while before I was exposed > to wireless networking—smartphones weren't a thing yet, and laptops > were still hideously expensive, underpowered, and overweight. I was > already rocking Fast Ethernet (100 Mbps) wired networks in all my > clients' offices and my own house, so the idea of cutting my speed by > 90 percent really didn't appeal. > > In the early 2000s, things started to change. Laptops got smaller, > lighter, and cheaper—and they had Wi-Fi built in right from the > factory. Small businesses started eyeballing the "11Mbps" that 802.11b > promised and deciding that 10Mbps had been enough for them in their > last building, so why not just go wireless in the new one? My first > real exposure to Wi-Fi was in dealing with the aftermath of that > decision, and it didn't make for a good first impression. Turns out > that "11Mbps" was the maximum physical layer bit rate, not a speed at > which you could ever expect your actual data to flow from one machine > to another. In practice, it wasn't a whole lot better than dial-up > Internet—in speed or reliability. In real life, if you had your > devices close enough to each other and to the access point, about the > best you could reasonably expect was 1 Mbps—about 125 KB/sec. It only > got worse from there—if you had ten PCs all trying to access a server, > you could cut that 125 KB/sec down to 12.5 KB/sec for each one of them. > > Image: D-Link's DI-514 802.11b router. It was a perfectly > cromulent router for its time... but those were dark days, friend, > dark days indeed. > > > Just as everybody got used to the idea that 802.11b sucked, 802.11g > came along. Promising 54 screaming Mbps, 802.11g was still only half > the speed of Fast Ethernet, but five times faster than original > Ethernet! Right? Well, no. Just like 802.11b, the advertised speed was > really the maximum physical layer data rate, not anything you could > ever expect to see on a progress bar. And also like 802.11b, your best > case scenario tended to be about a tenth of that—5 Mbps or so—and > you'd be splitting that 5 Mbps or so among all the computers on the > network, not getting it for each one of them like you would with a > switched network. > > 802.11n was introduced to the consumer public around 2010, promising > six hundred Mbps. Wow! Okay, so it's not as fast as the gigabit wired > Ethernet that just started getting affordable around the same time, > but six times faster than wired Fast Ethernet, right? Once again, a > reasonable real-life expectation was around a tenth of that. Maybe. On > a good day. To a single device... > > > > In full > https://arstechnica.com/information-technology/2017/03/802-eleventy-what-a-…

1 0

sweden, leader of the Free World
by juan 04 Mar '17

04 Mar '17

now has free conscription! http://www.bbc.com/news/world-europe-39140100 war is peace and slavery is freedom

1 0

ROTF! "Imperial Leftists"! (image: 90kb)
by Razer 04 Mar '17

04 Mar '17

1 0

Relatively Free: A twenty minute documentary about Barrett Brown.
by Razer 04 Mar '17

04 Mar '17

https://fieldofvision.org/relatively-free Player at top of main page autostarts. Totally free. > > Recently released from prison after a four year sentence, journalist > Barrett Brown reflects on his incarceration and future prospects as > his parents drive him to the halfway house. > > Ps. "When the prison gates open the dragon flies out." ~Ho Chi Minh.

4 5

Long, but very good: About Anti-Fascists and Anarchism
by jim bell 04 Mar '17

04 Mar '17

https://attackthesystem.com/2017/02/22/against-the-anti-fascist-creeps/ [partial quote follows] Academic Gloss for the AntifaFor decades, a minor cottage industry of professional “anti-racists” and “anti-fascists” has existed for the purpose of perpetually sounding the alarm about the imminent threat posed by supposed “far right extremists.” The most well-known and influential of these is the Southern Poverty Law Center, which has raked in millions of dollars largely by frightening elderly liberals and Jews old enough to remember the Holocaust with hobgoblin tales about the supposedly persistent rise of neo-Nazism in America. The fundraising tactics of the SPLC are nearly identical to those of televangelists soliciting funds from elderly Christians by spinning tales about the supposed infiltration of the public schools by gay pedophiles. If one reads the literature of the SPLC and, for example, the publications of religious right organizations such as Focus on the Family and Coral Ridge Ministries, parallel themes will soon become noticeable. While the SPLC and a similar organization, the Anti-Defamation League, are the major league players in the “anti-fascism” industry, there are a number of minor league players as well ranging from the Ford Foundation-funded (how is that for irony?) Political Research Associates to AK Press, a small publisher oriented towards the “antifa” sector of the wider “anarchist” milieu.The antifa (an abbreviation for “anti-fascist”) are a loose collection of leftist youth gangs that exist primarily in Europe and the United States, and whose participants typically fancy themselves as front line warriors against the always imminent Fourth Reich. In reality, the antifa are largely a collection of overgrown juvenile delinquents specializing in petty vandalism and stalking activities. The antifa occasionally engage in physical assaults, but only when they greatly outnumber their intended victims, and with the most defenseless people often being the target. I have personally witnessed the antifa attacking both women and elderly people. When the antifa have targeted more formidable enemies, their limited capabilities as street fighters have been quickly revealed. During a confrontation with members of white nationalist organizations in Sacramento during the summer of 2016, a group of approximately 200 “anti-fascists” attempted a swarm attack on about 30 members of the “right-wing” organizations that were present. Half a dozen of the antifa consequently received stab wounds in what was a pretty puny performance on their part, to say the least.Multiple individual writers also exist who attempt to provide an academic gloss for the antifa, including Chip Berlet, Matthew Lyons, Spencer “Sunshine,” and others. One such individual is Alexander Reid-Ross whom the leftist webzine Truth-Out describes as a geography instructor at Portland State University. Reid-Ross recently released a book titled “Against the Fascist Creep,” published by the previously mentioned AK Press. This book has since been praised in some leftist circles so it is interesting to take a look at its actual claims and arguments.The Protocols of the Learned Elders of Thule“Against the Fascist Creep” presents a lengthy narrative that purports to outline the means by which “fascists” are supposedly engaged in a persistent and ongoing effort to infiltrate and co-opt the left in order to advance one or another nefarious agenda. Reid-Ross takes his seemingly intricate knowledge of “far right” movements and organizations and spins this into a conspiracy narrative about the endless effort by fascists to infiltrate the perpetually beleaguered and victimized left. How does this “fascist creep” actually work? Reid-Ross describes two methods: “Hence, fascism creeps in two ways: (1) it draws left-wing notions of solidarity and liberation into ultranationalist, right-wing ideology; and (2), at least in its early stages, fascists often utilize ‘broad front’ strategies, proposing a mass-based nationalist platform to gain access to mainstream political audiences and key administrative positions.”

7 14

[WAR] Mr Trump, please disband the CIA, good men continue to die at their hands...
by Zenaan Harkness 04 Mar '17

04 Mar '17

This must stop. Analyst: CIA killed Russian Ambassadors [Video] http://www.fort-russ.com/2017/02/analyst-cia-killed-russian-ambassadors.html

1 0