- cypherpunks - lists.cpunks.org

request for comment re "contributor-covenant.org"
by Zenaan Harkness 12 Feb '16

12 Feb '16

Hi cp-ers, On the PostgreSQL database mailing list pgsql-general(a)postgresql.org , they are discussing a Code of Conduct. A reference and discussion came up around contributor-covenant.org and it seems many (allegedly 1000's of "open source projects" have "adopted" it, and there appears to quite the campaign to "encourage" the PostgreSQL project to likewise adopt that particular agreement. The pgsql old hands appear to have rejected it. This is a rare thing AFAICT. There are a few issues raised about the so-called "contributor covenant" which have very clearly, and repeatedly, not been responded to, and this has been pointed out, more than once. Those who chaperone one or more "open source" project mailing lists may wish to bring themselves up to speed with this so-called "covenant" before the steamroller hits your group/ list/ community, since it seems inevitable at this point. Being riveted and enraptured by concepts of "enforcement", "protection" of "the marginalized peoples" and as y'all know, my raving crusade to further promote "political correctness", I figured I should go and read this "covenant" to find out what all the fuss might be about and add some scare quotes at appropriate places. So I went and read it. It simply, abso-firetruckingly, demands a response, and beyond what appears to have currently been tippy toe on eggshells burped out so far. Here is my first draft to respond to it, I encourage others to refine my oh-so-subtle analysis, but most importantly to bring yourself up to speed with the PC-speak which might freight train into one or more of your "open source" worlds in the relatively near future; informed ahead of time may be enough to be armed against long and actually divisive email discussions, as internet searching sadly tells. The below is my second woeful attempt to bring some sanity to that "covenant". It needs your improvements. Good luck, Zenaan ---- http://contributor-covenant.org/ >> Contributor Covenant >> A Code of Conduct for Open Source Projects. Sounds reasonable. >> Open Source has always been a foundation of the Internet, and with the advent >> of social open source networks this is more true than ever. Let's hope free libre and open source software - FLOSS, stays as the foundation of the Internet! "social open source networks" - what?? Facebook social network?? Use of new terminology, without explaining that terminology, and presuming it is known and well understood terminology, in a document you are pushing as a new and additional "social contract" which others are pressed upon to adopt and enforce, is IMHO passive aggressive. >> But free, libre, and open source projects suffer from a startling lack of >> diversity, with dramatically low participation by women, people of color, and >> other marginalized populations. Those who have an interest in promoting, assisting, sponsoring and generally facilitating "the diversity" within this particular libre software project or mailing list, are welcome to do so and in general, ought be supported to the extent that their actions and words are neither actively nor passively aggressive towards any member of this mailing list, and are actually supportive of the technical goals of this project. >> Part of this problem Lack of diversity may be viewed as a problem. Such a viewpoint is a personal, individual matter. Your personal, individual opinion on this matter may be discussed, but in general is off topic for this mailing list. Speaking or writing that "lack of diversity is a problem", and even moreso, building the presumption into the words of a so-called "social covenant", where that presumption is almost hidden and "not up for debate", is a passive aggressive approach to communication with others who may or may not disagree with this position. Passive aggressive communication is not welcome on this mailing list. >> lies with the very structure of some projects: What is "the very structure of a project"? This phrase is too generic, and not explained, despite the next part of that sentence which follows below, which appears to pretend to answer (or define) the phrase - it does not. Phrases and terminologies used out of context and having indefinite and vague meanings, is a sign of passive aggressive communication and all members of this mailing list are encourage to ridicule such communication. >> the use of insensitive language, thoughtless use of pronouns, assumptions of >> gender, and even sexualized or culturally insensitive names. Although certain social niceties are encouraged on this mailing list, they are not required and indeed firm, clear and precise languaging is valued and encouraged. If you are overly sensitive, or in need (or desire) of an emotionally sensitive environment, then consider another mailing list - this mailing list is likely not for you, and if you are in need of any professional help, you are encouraged and indeed required to seek professional medical and or psychological advice and or support. >> Marginalized people also suffer some of the unintended consequences of >> dogmatic insistence on meritocratic principles of governance. There are forums and mailing lists which are suitable for those who have learning difficulties (reference?), for those who need an emotionally sensitive environment (be sure to check if you need professional medical or psychological support), and for those who are beginniners in the field of technology discussed on this mailing list. In all of these cases, this mailing list is not for you, and you will be encouraged to leave if we discover that any of these conditions apply to you. Take note, we heartily welcome the opportunity to joust against your best attempts to otherwise deceive us in regards to such conditions applying to you, although in general in such cases, please expect derision and ridicule for wasting our time in such circumstances. >> Studies have shown that organizational cultures that value meritocracy often >> result in greater inequality. This is a baseless assertion. Provide the references or go away. Such an unsupported, unreferenced and 'plastic' attempt to dominate our community into conforming, acting and behaving according to your standards is unwelcome in the extreme, and grounds for the ridicule of you. In any case, this mailing list is for those who have a minimum intermediate skill and understanding in the programming languages and technologies for which it has been established, and is explicitly not for those who are overly sensitive and need an emotionally supportive environment - we might have a laugh, and it may be at your expense, so if you can't laugh at yourself, this mailing list is definitely not for you. >> People with "merit" are often excused for their bad behavior in public spaces >> based on the value of their technical contributions. You may join this mailing list, but by doing so you agree to speak clearly and assertively if you feel offended, or otherwise to respectfully leave the mailing list, as it is unmoderated and uncensored, although discussion is generally sought to be on topic, and for offtopic digressions to be kept short and taken offlist or to an alternate list if they persist. Additionally, your consideration that this mailing list is a public space, is only partially correct. This mailing list is a list which is open to conditional membership, and the list administrator reserves the right to ban you temporarily and or permanently at any time, but with prior notice and opportunity for discussion given on this mailing list. Take Notice further that the discussions had by members of this mailing list are archived publicly, so to this extent the list may be considered public, whilst it is strictly a members only mailing list who choose to have certain public discussions, which may include attempting to ridicule -you-, so obtain a temporary membership to this email mailing list only after very careful consideration by you. If you are at all unsure of your suitability to our list, we are happy to help you decide by analysing your proposed introduction email of yourself. >> Meritocracy also naively assumes a level playing field, in which everyone has >> access to the same resources, free time, and common life experiences to draw >> upon. The sentence above is another passive-aggressive, presumption filled projected assertion. Such communication has no place on this mailing list, except as the target of naming the presumptions, highlighting the passive aggressive nature and generally tearing it to shreads and providing an opportunity for the mailing list members to laugh like hyenas. - >> "Meritocracy naively assumes" Meritocracy does no such thing - it is not a person. - >> "Meritocracy also naively assumes a level playing field," Meritocracy does no such thing - in fact it is the opposite - meritocracy is a socio political agreement, contract and or requirement that participants in the system shall be judged based on their technical merit and or performance. In our case, slow performance is entirely acceptable, you are under no requirement nor expectation to make contributions according to any schedule, only on your own free time and personal pleasure. Making any assertion to the contrary is passive aggressive, manipulative, and shall be joyously and most light heartedly attacked in words. - >> "in which everyone has access to the same resources, free time," No such assumptions are made on this mailing list, and quite the contrary - if you have very little free time for example, or a slow computer, then we will certainly expect that your contributions may be few and far between as compared with someone who has loads of free time or a faster computer than you. If you are experiencing free time and resources problems, then this list is DEFINITELY not the place for you - you are explicitly instructed to seek professional time management advice as well as professional financial counselling. DO NOT bring such personal problems to this mailing list, as they will be used as instant grounds for removal and for barring from the list, although more likely simply as grounds for ridicule and laughing like hyenas. - >> "and common life experiences to draw upon." Once again, "meritocracy" (to the extent we can personify a socio political system), and "we" the members of this mailing list in particular, make no such assumptions whatsoever, and we more importantly, put no such requirements upon you. So sleep tight, it's all alright, we won't hold your differing life experiences against you, in fact we may be intrigued, but if a particular experience you share starts to cause an extended off topic discussion, take notice that we reserve the right to calmly let you know this so that we can get back to the topics intended for this mailing list. This list may be a platform, but at most only for those robust enough to hold their own on the topic they make a post about. If you join this mailing list, you are strongly encouraged to communicate your personal concerns and problems, needs and requirements at the earliest stage possible, preferably in in your introduction email with a well identified subject line. Then we will be able to readily assess whether this mailing list is suitable for you or whether you need to find another, more appropriate environment in which to express yourself and or to find a "contribution space" which is suitable for your needs. If you are unsure, then you are welcome to introduce yourself in this way, and we will respectfully assess your suitability to the mailing list as best we can. Take notice that we are not professionals in any field, indeed we are amateurs that might be in your personal medical or other interests to NOT associate with, and that if you require any professional advice, medical or otherwise, then you are required to seek such advice from suitably certificated professionals in your area - we on this mailing list cannot help you in such circumstances and if you fail to inform us of any such problems and or issues you may have that you consider we would otherwise be responsible for, then you may be in breech of the legislation in your jurisdiction - deceive the members of this mailing list at your own legal liability. On this mailing list, robust communication is a prime valued contribution - if you are actively wanting to improve your emotional robustness, this mailing list could possibly be a suitable place for you - feel free to ask us about this specifically in relation to you. >> These factors and more make contributing to open >> source a daunting prospect for many people, If your emotional strength, your social and or communication capacity, and or your psychological needs are an issue in any way, you are not welcome on this mailing list and we require you to seek professional medical advice. >> especially women and other underrepresented people. (For more critical >> analysis of meritocracy, refer to this entry on the Geek Feminism wiki.) If you have any trigger words, emotional weaknesses and or sensitivities which may cause you to have any reaction whatsoever, you are required to inform the members of this mailing list in an introduction email if you do join the list, and if you are required to do so, you must seek professional medical and or psychological advice and support - this mailing list is most likely an inappropriate place for you to join, and we continue to encourage ourselves to not hold back in reminding you this. >> A Small Step Forward >> An easy way to begin addressing this problem You may have some problem, and this mailing list not the place for you to fix your problem. Only technical matters related to the technical topic of this mailing list are appropriate problems for fixing in discussions on this mailing list. Seek professional advice when you need it, including professional advice regarding the technical topic of this mailing list if that is what you require - this mailing list is for non professionals with at least moderate technical competence, all members are volunteers, all members participate at their own discretion and with no obligations upon them and with no obligations whatsoever to you, including courtesy which is valued, but not required - enter at your own risk. >> is to be overt in our openness, welcoming all people to contribute, and >> pledging in return to value them as human beings and to foster an atmosphere >> of kindness, cooperation, and understanding. This we agree with - we, the members of this mailing list, proclaim our intention to welcome all people to contribute, and to value each member as a human being. We encourage each other to foster an atmosphere of kindness, cooperation and understanding, and robustness in communication - passive aggressive communication, despite the best intentions of the one making such passive aggressive communication, has no place in our community. And take notice - persistent bad behaviour, 'bad' by the assessment of the members alone and discussed publicly on this mailing list, shall be cause for temporary and or permanent banning from this mailing list. >> The Contributor Covenant can be one way to express these values. Pledge your >> respect and appreciation for contributors and participants in your open >> source project by adding an explicit CODE_OF_CONDUCT.md to your project >> repository. Respect, kindness and cooperation are good things, but this "http://contributor-covenant.org/" "contributor covenant" to which we hereby respond, is in no way or shape getting into our project's repository without this our response. >> The Contributor Covenant uses semantic versioning for revisions so all URLs >> are permanent. Previous versions are available here: 1.0, 1.1, and 1.2 >> Using the Contributor Covenant >> We recommend that you add the Markdown or text version of the Contributor >> Covenant to your source code repository at the root level. >> Thanks to Simon Vansintjan there is an automated way to add Contributor >> Covenant to your project. Assuming that you have node installed, simply run >> the following two commands from your project folder: >> npm install -g covgen >> covgen your_email_address >> You may want to add language similar to this to introduce your code of conduct: >> Please note that this project is released with a Contributor Code of >> Conduct. By participating in this project you agree to abide by its >> terms. >> You may also use the permalinks given above to reference from your project >> home page. >> Important! You must add a contact method to the placeholder in the document >> so that people know how to report violations. Enforcing the Contributor >> Covenant This above paragraph does not quite feel right. If the members of this mailing list are so anti-social that genuine "social problems" cannot be resolved on the mailing list itself, then this "community" of members is quite likely beyond repair without substantial work by robust individuals with a passion to heal the community - if you are not such an individual, then you best leave that job to comeone who is, and take yourself to a kinder, gentler happy place. >> Do not simply add the Contributor Covenant to your project and assume that >> any problems with civility, harassment, or discrimination will be solved. As >> a project maintainer you must be committed to enforcing the code of conduct. There may be a time and place for banning members from this mailing list, temporarily and or permanently, but such discussions shall continue to be public, on the mailing list itself and open to discussion and contribution by all members. No duty is incumbent upon any member, including the "project maintainer" - if the community can't work out its problems, it is unfair to place such a burden upon such a one individual. >> A code of conduct without enforcement sends a false signal that your project >> is welcoming and inclusive, and can create a dangerous situation for >> marginalized people who participate. "Marginalized people" who are not competent to contribute on some technical level (which includes documentation writing, testing as well as programming), are not welcome - we the members of this mailing list are volunteers and, on this particular mailing list, are not willing to tutor those who have special needs - do not join the mailing list in such circumstances, there are other, appropriate forums, mailing lists and learning institutions which you ought apply to. Genuinely anti-social communication is actively discouraged, and this includes those who communicate deceptively regarding their own needs and or social environment requirements, as well as those who communicate in a passive aggressive way. If you this any of these types of communication may apply to you, then be prepared to suffer the consequences should you join this mailing list - we shall roast you in words, with glee! >> Adding the Contributor Covenant to a project places responsibility on the >> project team that must not be taken lightly. Since the archives of this mailing list are public, should you have even the smallest concern regarding your own robustness in public communication, then you are invited to browse those archives and make an assessment as to whether you are a suitable candidate to join this mailing list. If you do decide to join, you are required to make your first email an introduction, which introduction includes a reference to your assessment of the archives as well as any needs you feel that the members of this list ought be able to meet. >> Before adopting the Contributor Covenant take the time to discuss and decide >> how to deal with problems as they emerge. Document the policy and procedure Oh, we've taken the time, and "problems as they emerge" shall be handled publicly, on this mailing list! To the extent we the members of this maliing list consider you a problem, passive aggressive or otherwise, we WILL handle you, publicly, with the one caveat that all members are in general expected to show respectful consideration in respect of all private or "off-list" communications. If you are uncomfortable with this policy, you are encouraged to find a more suitable community to join. >> for enforcement, and add it to your README or in another visible, appropriate >> place. Consider if your project team has the willingness and maturity to >> follow through on your enforcement procedures. A "community" that requires any significant policing, particularly clandestine policing, has lost its way - the tyranny of the majority is not the healthiest way, in the opinion of some members - speak clearly, speak the truth, and seek a fair response; if you don't receive a fair response, another community might be much less work for you, even if it provides less opportunities for emotional growth for you.

12 19

Cryptsy theft->bankruptcy
by dan＠geer.org 12 Feb '16

12 Feb '16

...You probably want to see the article (jpegs of relevance)... www.databreachtoday.com/bitcoin-heist-steals-millions-from-exchange-a-8803 Cryptsy Faces Potential Bankruptcy Over Just-Revealed 2014 Hack Mathew J. Schwartz (euroinfosec) o January 15, 2016 Bitcoin Heist Steals Millions from Exchange Cryptocurrency exchange Cryptsy, which trades bitcoins as well as more than 100 types of "altcoins" such as litecoin and namecoin, disclosed Jan. 15 that it was robbed in 2014. As a result of the breach, the exchange has now suspended all trades and says it will file for bankruptcy unless the stolen bitcoins are returned. Florida-based Cryptsy says the attacker stole 13,000 bitcoins, worth $5 million today, as well as 300,000 litecoins, worth $970,000 today. The exchange says the theft was not related to the recent phishing and distributed denial-of-service attacks that it's suffered. It suspects that the most recent developer behind Lucky7Coin - LK7 - is the culprit behind the attacks, based on a backdoor that it found inside its network. "About a year and a half ago, we were alerted ... a reduction in our safe/cold wallet balances of bitcoin and litecoin, as well as a couple other smaller cryptocurrencies," Cryptsy says in a blog post. It says its investigation ultimately found that the developer of the Lucky7Coin cryptocurrency "had placed an IRC backdoor into the code of wallet, which allowed it to act as a sort of a Trojan, or command-and-control unit." The exchange adds: "This Trojan had likely been there for months before it was able to collect enough information to perform the attack," which was executed on July 29, 2014. A user of code-sharing site GitHub in March 2015 detailed that apparent backdoor in the Lucky7Coin IRC code, noting that it would give an attacker "the ability to run arbitrary commands on the victim's host." Cryptsy suspects that whoever originally developed Lucky7Coin isn't responsible for the backdoor, but rather someone named "Jack," who claimed to have taken over development of the cryptocurrency codebase and related code, and who contacted Cryptsy on May 22, 2014. "You're the only exchange for this coin and I hope you will let me take care of it. I'm responsible," Jack claimed. Message From New Lucky7Coin Developer [Cryptsy-720.jpg] Cryptsy says it fell for a Trojan attack initiated by "Jack." Connection to Jailed 'Silk Road' Secret Service Agent Cryptsy is not the first exchange to have faced insolvency after hackers stole its bitcoins (see Bitcoin Exchange Hacked With Word Macro). But why didn't the exchange come forward sooner? Officials at Cryptsy couldn't be immediately reached for comment. But in the blog post, Cryptsy says it initially tried to cover the missing funds using its exchange profits and appears to suggest that everyone would have been worse off, had it gone to authorities, because its U.S. Secret Service contact was none other than Special Agent Shaun Bridges. "I think we all know what happened with him," the Cryptsy blog post notes. In August, Bridges pleaded guilty to both money laundering and obstruction of justice. He was accused of abusing his position while a member of the Secret Service's Electronic Crimes Task Force that was investigating the notorious darknet narcotics marketplace called Silk Road (see Former Secret Service Agent Pleads Guilty to $800K Bitcoin Theft). Cryptsy, which is a member of the Financial Crimes Enforcement Network, also says it attempted to contact the FBI Miami field office recently, but was redirected to the Internet Crime Complaint Center. IC3, as it's also known, is run by the FBI, the National White Collar Crime Center and the U.S. Bureau of Justice Assistance; it deals with Internet crime complaints (see Hackers Claim FBI Information-Sharing Portal Breached). The exchange says it has yet to hear back from IC3. Will Missing Bitcoins Come Home? Cryptocurrency news site CoinDesk reports that declining trading volumes have undercut the exchange's profits and that the exchange has halted trading twice in the past two weeks, blaming one of those outages on a phishing attack that employed users' email addresses and phone numbers. But a class-action lawsuit filed Jan. 13 against Project Investors - doing business as Cryptsy - and Paul Vernon, who it says is the founder, operator, and CEO of Cryptsy, alleges that since November 2015, "certain Cryptsy users started having difficulties and inabilities withdrawing any and all forms of currency from their accounts." The plaintiff, Virginia-based Jinyao Liu, "seeks damages based upon the unlawful conduct of defendants in denying account holders the ability to obtain funds in their accounts and in misappropriating funds held in the Cryptsy accounts," according to the lawsuit. Thank you everyone for the patience while we get these issues resolved. Team is working hard and we will try to do more frequent updates. BigVern (@cryptsy) December 10, 2015 In its Jan. 15 blog post, Cryptsy says it now faces a 10,000 bitcoin ($3.8 million) shortfall and identifies three available business options: It shutters the website and files for bankruptcy; someone purchases the exchange and makes good on the requested withdrawals; or the attacker returns the stolen bitcoins - no questions asked. While that might sound far-fetched, Cryptsy says that after the July 29, 2014, theft, based on the bitcoin wallet address tied to the theft, "those bitcoins have not moved once since this happened" which "gives rise to the possibility they can be recovered." To help, Cryptsy has offered a reward of 1,000 bitcoins ($380,000) for "information which leads to the recovery of the stolen coins." Bye-Bye, Litecoins Cryptsy doesn't reference the fate of the missing litecoins. But they appear to have been cashed out: On July 2, 2014, someone dumped exactly 300,000 litecoins - quite a coincidence - onto an exchange all at once, which was such a large volume of coins that it temporarily drove down the price of each individual litecoin from $8.50 to just $2. As noted on a related Reddit conversation: "The volume was so high that he basically chewed through the entire buy side of the order book, all the way down to someone who had (probably on a lark) put in a buy order at $2," reports Reddit user FreeJack2k2. "After clearing out the ask side of the order book, the new sell orders only dropped to the low $7 range (the recovery from $2 was immediate) and eventually got bought back to where we are now, at around $8. Whoever had that $2 buy order in the books made out like a bandit."

2 1

Self Preservation and Irreversible Decline [was: Electronic Freedom Foundation selective in support of freedom]
by coderman 11 Feb '16

11 Feb '16

On 1/6/16, Sean Lynch <seanl(a)literati.org> wrote: > ... I've found myself self-censoring quite a lot more > since my kids were born. this topic has been on my mind recently, "You know, It would be a lot easier you just didn't do X" "This wouldn't happen if you quit annoying Y" "If you accept, Z will pay nicely and protect you." where X is FOIA requests, security research, PET development, etc., Y is some powerful entity like FBI, NSA, Verizon, Intel, etc., and Z is some convenient but forever bound by position requiring a clearance and suspension of moral qualms. when you've got the world to loose (nothing more encompassing than your own family!) preservation is near irresistible. simple fear of harm might be compelling enough for the majority to cower compliant, even. --- when i was young, these questions of "do i do right? or do i stay safe?" were abstract and applicable only to foreign backwaters or past history. a modern, free liberal democracy need never exercise such restraint - we have Blind Justice which always finds in favor of the righteous! over some years i lost this innocent faith in perfect justice, saw abuses of power against the less fortunate or less familiar, accrued things dear to me like friends and new family, and became comfortable in a lifestyle with all needs met. . . . now USA in a state of perpetual war, executive power at record levels, surveillance staggering in breadth and invasiveness, censorship and suppression of speech creeping ever further into the centralized systems dominating over our way of life, it's not good... and yet we're not rounding up foreign-born citizens and their families for incarceration at detention camps (like Japanese during the war). not to mention that much of the rest of the world would be killed or imprisoned leading my kind of life in another jurisdiction! when people are being killed for exposing corruption or injustice, it seems ridiculous to complain about annoyances resulting from optional activities i have chosen to undertake willingly - not out of dire need or coercion. with all my needs still met. --- all of which made me wonder, what did the every day German or Italian citizen see before fascism ravaged sanity? what did they see that felt disturbing, but not overtly threating and could be ignored? what did they see which told them all legitimacy was lost and only resistance remained? the #YallQueda rebellion staged their last stand in my state, with land use abuse the straw upon their broken backs. perhaps loss of livelihood a better Rubicon? --- then another "If you quit doing that, it would all be much easier..." was said, and i wondered if this was the key sign of trouble i was fearing to see. when lawful activities performed for the good of the public draw unjustified scrutiny and disruption from the state, has the state itself become corrupt? how far must this corruption spread before it cannot be stopped without destruction of the state, no matter the size and vehemency of public protest? can the tools of technology and manufactured consent provide the state ability to become completely corrupted without detection, nor resistance from the public? --- i don't know the answers, and i am curious to hear opinions. i still live a rich life with needs met and i don't think we're on the brink of a fascist nightmare future. maybe hell on earth is closer than i think... thoughts? best regards, NOTE: i am using the terms fascist and fascism explicitly, not capriciously. ''' Fascism is a form of radical authoritarian nationalism that came to prominence in early 20th-century Europe... Fascists saw World War I as a revolution that brought massive changes in the nature of war, society, the state, and technology. The advent of total war and total mass mobilization of society had broken down the distinction between civilian and combatant. A "military citizenship" arose in which all citizens were involved with the military in some manner during the war. The war had resulted in the rise of a powerful state capable of mobilizing millions of people to serve on the front lines and providing economic production and logistics to support them, as well as having unprecedented authority to intervene in the lives of citizens. Fascists view World War I as having made liberal democracy obsolete, and regard total mobilization of society under a totalitarian one-party state as necessary to prepare a nation for armed conflict and to respond effectively to economic difficulties. Such a state is led by a strong leader — such as a dictator and a martial government composed of the members of the governing fascist party — to forge national unity and maintain a stable and orderly society. Fascism rejects assertions that violence is automatically negative in nature, and views political violence, war, and imperialism as means that can achieve national rejuvenation. ''' - https://en.wikipedia.org/wiki/Fascism

12 38

Gehlen Organization counterintelligence projects
by Michael Best 11 Feb '16

11 Feb '16

Here's the CIA file for Gehlen counterintelligence projects: https://archive.org/details/UJDROLLERY Enjoy. More at http://that1archive.neocities.org/subfolder1/early-cia.html --Mike http://that1archive.neocities.org

1 0

openssl and libressl are shipping broken in 2009 elliptic curve secp112r1
by Georgi Guninski 11 Feb '16

11 Feb '16

openssl and libressl are shipping broken in 2009 elliptic curve secp112r1. $openssl ecparam -list_curves secp112r1 : SECG/WTLS curve over a 112 bit prime field http://lacal.epfl.ch/112bit_prime >PlayStation 3 computing breaks 2^60 barrier 112-bit prime ECDLP solved >This elliptic curve is standardized in the Standard for Efficient >Cryptography (SEC), SEC2: Recommended Elliptic Curve Domain Parameters >as curve secp112r1 and in the Wireless Transport Layer Security >Specification Good luck to those who have crypto ideals.

2 2

RE: Re: request for comment re "contributor-covenant.org"
by shakeitoff＠ghostmail.com 11 Feb '16

11 Feb '16

Hi Ted, Yes, I agree with you. Supposedly, this list was for anarchists who wanted to advance strong cryptography and individual liberty. However, it seems like the large majority of postings here are unfortunately not about cryptography, nor anarchy. Agreed about the white fascism. The ideal would be idea to have more code, more crypto. However, as you said, it might be a lost cause. Which is quite sad, considering what it originally represented. But thanks for writing this nonetheless :) On Mon, Feb 8, 2016 at 1:42 PM, Ted Smith <tedks(a)riseup.net> wrote: Somewhat confusing threading here Cari. I see a few possibilities as to what I could do here: * Be vigilant in calling out patriarchal, racist, and generally neoliberal or fascist ideas promoted by some of the more recent arrivals. * This would provided a benchmark on the list indicating that these ideas are not generally accepted. * This would also require me to argue with assholes on the Internet. As the say goes, pigs, mud, etc.. * Filter these people out and try to maintain productive on-topic discussion. * This would be of limited usefulness since people who I generally find to be quality contributors continue to respond to the Stormfront-esque crowd. * Filter the whole list, comb through it periodically to see if there is any useful signal, and call out the most egregious offenses I can find. * This is what I've chosen to do since it is optimal from my time perspective. I think this list is a lost cause at this point. Ever since around the time it became more discoverable after the switch from al-qaeda.net to cpunks.org, and some possibly overzealous cross-posting, the discourse has shifted from actual cypherpunkery to white men complaining about having their privilege eroded on other mailing lists. There are a number of quality contributors that no longer post here, reducing the signal and allowing more noise. I can't bring them back. But I can at least remind anyone more moderate listening that the cypherpunks list wasn't always a far-right discussion group, which I think is the reverence due to the community that used to exist. I'd appreciate any suggestions, onlist or offline, from anyone who thinks similarly of the ideological drift of this list from generally anti-authoritarian to crypto-white nationalism. Mon Feb 08 2016 6:30:25 PM from dan(a)geer.org ------------------------------ By my records, the word "sheeple" appears in 2% of all messages posted on this list, making it demonstrably ironic that we are even discussing a call for something other than meritocracy. --dan Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

8 8

"Welcome to London!" aka, the Internet is now DEF CON Wireless
by coderman 10 Feb '16

10 Feb '16

https://conspicuouschatter.wordpress.com/2016/02/03/a-technical-reading-of-… A technical reading of the “HIMR Data Mining Research Problem Book” 3 February 2016 Boing Boing just released a classified GCHQ document that was meant to act as the Sept 2011 guide to open research problems in Data Mining. The intended audience, Heilbronn Institute for Mathematical Research (HIMR), is part of the University of Bristol and composed of mathematicians working for half their time on classified problems with GCHQ. First off, a quick perusal of the actual publication record of the HIMR makes a sad reading for GCHQ: it seems that very little research on data mining was actually performed post-2011-2014 despite this pitch. I guess this is what you get trying to make pure mathematicians solve core computer science problems. However, the document presents one of the clearest explanations of GCHQ’s operations and their scale at the time; as well as a very interesting list of open problems, along with salient examples. Overall, reading this document very much resembles reading the needs of any other organization with big-data, struggling to process it to get any value. The constrains under which they operate (see below), and in particular the limitations to O(n log n) storage per vertex and O(1) per edge event, is a serious threat — but of course this is only for un-selected traffic. So the 5000 or so Tor nodes probably would have a little more space and processing allocated to them, and so would known botnets — I presume. Secondly, there is clear evidence that timing information is both recognized as being key to correlating events and streams; and it is being recorded and stored at an increasing granularity. There is no smoking gun as of 2011 to say they casually de-anonymize Tor circuits, but the writing is on the wall for the onion routing system. GCHQ at 2011 had all ingredients needed to trace Tor circuits. It would take extra-ordinary incompetence to not have refined their traffic analysis techniques in the past 5 years. The Tor project should do well to not underestimate GCHQ’s capabilities to this point. Thirdly, one should wonder why we have been waiting for 3 years until such clear documents are finally being published from the Snowden revelations. If those had been the first published, instead of the obscure, misleading and very non-informative slides, it would have saved a lot of time — and may even have engaged the public a bit more than bad powerpoint. Some interesting points in the document in order: It turns out that GCHQ has a written innovation strategy, reference [I75]. If someone has a copy it would be great to see it, and also understand where the ACE program fits in it. GCHQ, at the time used heavily two families of technologies: Hadoop, for bulk processing of raw collected data (6 months for meta-data apparently), and IBM Streams (DISTILLERY) for stream, real-time, processing. A lot of the discussion, and open problems, relate to the fact that bulk collection can only provide a limited window of visibility, and intelligence related selection, and processing has to happen within this window. Hence the interest in processing streaming data. Section 2 is probably the clearest explanation of how modern SIGINT works. I would like to congratulate the (anonymous) author, and will be setting it as the key reading for my PETS class. It summarizes well what countless crappy articles on the Snowden leaks have struggled to piece together. I wish journalists just released this first, and skipped the ugly slides. The intro provides a hit at the scale of cable interception operations as of 2011. It seems that 200 “bearers” of 10 Gigabit / sec were being collected at any time; it makes clear that many more sources were available to switch to depending on need. That is about 2 Terabit / sec, across 3 sites (Cheltenham, Bude, and LECKWITH). Section 2.1.2 explains that a lot (the majority) of data is discarded very early on, by special hardware performing simple matching on internet packets. I presume this is to filter out bulk downloads (from CDNs), known sources of spam, youtube videos, etc. The same section (2.1.2) also explains that all meta-data is pulled from the bearer, and provides an interpretation of what meta-data is. Finally (2.1.2) there is a hint at indexing databases (Query focused databases / QFD) that are specialized to store meta-data, such as IP traffic flow data, for quick retrival based on selectors (like IP addresses). Section 2.1.3 explains the problem of “target development”, namely when no good known selectors exist for a target, and it is the job of the analyst to match it though either contact chaining or modus-operandi (MO) matching. It is a very instructive section, which is the technical justification underpinning a lot of the mass surveillance going on. The cute example chosen to illustrate it (Page 12, end of 2.1.3): Apparently GCHQ developed many of those techniques to spy on foreign delegations during the 2009 G20 meeting. Welcome to London! Section 2.2.2 provides a glimpse at the cybersecurity doctrine and world-view at GCHQ, already in 2011. In particular, there is a vision that CESG will act as a network security service for the nation, blocking attacks at the “firewalls”, and doing attribution (as if the attacks will be coming “from outside”). GCHQ would then counter-attack the hostile sources, or simply use the material they intercepted from others (4th party collection, the euphemism goes). Section 2.2.3 provides a glimpse of the difficulties of running implants on compromised machines: something that is openly admitted. Apparently ex-filtrating traffic and establishing command-and-control with implants is susceptible to passive SIGINT, both a problem and an opportunity. Section 3 and beyond describes research challenges that are very similar with any other large organization or research group: the difficulty of creating labelled data sets for training machine learning models; the challenges on working on partial or streaming data; the need for succinct representations of data structures; and the problem of inferring “information flow” — namely chains of communications that are related to each other. It seems the technique of choice when it comes to machine learning is Random Decision Forrests. Good choice, I also prefer it to others. They have an in-house innovation: they weight the outputs of each decision tree. (Something that is sometimes called gradual learning in the open literature, I believe). Steganography detection seems to be a highlight: however there is no explanation if steganography is a real problem they encountered in the field, or if it was an easy dataset to generate synthetically. Section 4, deals with research problems of “Information Flow in Graphs”. This is the problem of associated multiple related connections together, including across types of channels, detecting botnet Command and Control nodes, and also tracing Tor connections. Tracing Tor nodes is in fact a stated problem, with a stated solution. Highlights include the simple “remit” algorithm that developed by Detica (page 26, Sect. 4.2.1); PRIME TIME that looks at chains of length 2; and finally HIDDEN OTTER, that specifically targets Tor, and botnets. (Apparently an internal group codenamed ICTR-NE develop it). Section 4.2.2 looks at communications association through temporal correlation: one more piece of evidence that timing analysis, at a coarse scale, is on the cards for mining associations. What is cute is the example used is how to detect all GCHQ employees: they are the ones with phones not active between 9am and 5pm when they are at work. Beside these, they are interested in change / anomaly detection (4.4.1), spread of information (such as extremest material), etc. Not that dissimilar from say an analysis Facebook would perform. Section 5 poses problem relating to algorithms on streaming graph data. It provides a definitions of the tolerable costs of analysis algorithms (the semi-streaming paradigm): for a graph of n vertices (nodes), they can store a bit of info per vertex, but not all edges, or even process all edges. So they have O(n log n) storage and can only do O(1) processing per event / edge. That could be distilled to a set of security assumptions. Section 5.2.2 / 5.2.3 is an interesting discussion about relaxations of cliques and also point of that very popular nodes (the pizza delivery line) probably are noise and should be discarded. As of 2011 (sect 5.2.4) it was an open problem how far contact chaining is required. This is set as an open problem, but states that analysis usually use 2-hops from targets. Note that other possible numbers are 3, 4, and 5 since after 6 you probably have included nearly everyone in the world. So it is not that exciting a problem and cannot blame the pure mathematicians for not tackling it. Section 5.5.1 asks the question on whether there is an approximation of the correlation matrix, to avoid storing and processing an n x n matrix. It generally seems that matching identifiers with identifiers is big business. Section 6 poses problems relating to the processing, data mining, and analysis of “expiring” graphs, namely graphs with edges that disappear after a deadline. This is again related to the constraint that storage for bulk un-selected data is limited. In section 6.3.2 the semi-streaming model where only O(n log n) storage per vertex is allowed, and O(1) processing per incoming event / edge is re-iterated. Appendix A deals with models of academic engagement. I have to say it is very enlightened: it recognizes the value of openly publishing the research, after some sanitization. Nice. Appendix B and C discuss the technical details and size of the IBM Streams and Hadoop clusters. Section D presents the production clusters (652 nodes, total 5216 cores, and 32 GB memory for each node). Section E discusses the legalities of using intercepted data for research, and bless them they do try to provide some logging and Human Rights Justification (bulk authorization for research purposes).

2 1

USA To Require Govt Issued ID To Use Internet, No More Anonymous
by grarpamp 10 Feb '16

10 Feb '16

http://yro.slashdot.org/story/16/01/20/1321243/senior-homeland-security-off… A senior Homeland Security official recently argued that Internet anonymity should outlawed in the same way that driving a car without a license plate is against the law. "When a person drives a car on a highway, he or she agrees to display a license plate," Erik Barnett, an assistant deputy director at U.S. Immigration and Customs Enforcement and attache to the European Union at the Department of Homeland Security, wrote. "The license plate's identifiers are ignored most of the time by law enforcement. Law enforcement will use the identifiers, though, to determine the driver's identity if the car is involved in a legal infraction or otherwise becomes a matter of public interest. Similarly, should not every individual be required to display a 'license plate' on the digital super-highway?"

10 71

I'll reveal the scandal I've been sitting on that's on the scale of Making a Murderer
by Ryan Carboni 10 Feb '16

10 Feb '16

I've inferred that somehow I'm being investigated as part of the 2013 Santa Monica College mass shooting which has taken a suspiciously long time to issue a report regarding (typically it appears to take a year or less). I've been subjected to police harassment before and after that point though. For legal reasons I can't explain further. Yes, exceptional claims require exceptional evidence. Fortunately systems are incapable of treating people as individuals, so there must be others. Obviously the claims of "gangstalking" are nuts. But there is the Rancid Honeytrap. http://i.imgur.com/19i7ik1.png Who for some reason is being trolled by Wikileaks? And Greenwald seems to be fine with people trolling him? https://ohtarzie.wordpress.com/2014/02/24/the-friends-of-glenn/ Perhaps there is now probable cause for a reasonable person to conclude that there's the potential of a pattern of government misconduct waiting to be uncovered. I made every reasonable effort to contact various advocacy / legal aid organizations when I felt I had enough evidence to merit some help and they have rejected me (I've sent large envelopes to them of multiple pages). I have made anonymous letters to various journalists hoping they would attempt to investigate a possible pattern of misconduct but I have seen no evidence that they have done it yet. I do not plan on acknowledging those anonymous letters as they were made a while ago, my memory isn't so great, and they could have been intercepted and modified in transit (especially since I didn't sign them). Now I'm going to shift to a rather benevolent interpretation of public events. Dianne Feinstein condemns Hoover, but the times were much more ambiguous in the Cold War, the commies were funding and supporting radicals, and there was a greater quantity of Progressive terrorism then than Islamic terrorism today (although the quality seems to be different since people are more afraid of Islamic terrorism). Director Comey condemns Hoover. Senator Wyden asked Clapper a question in public, under oath, and Clapper lied. Wyden is on the Senate's oversight committee over Clapper and Clapper still has his job. Lying to Congress is obviously an impeachable offense (unless Congress wants people to be employed by the taxpayers who lie to Congress). Clearly all these people are under duress, if their public statements are to taken as sincere expressions of opinion. Only legally allowed explanation I can give. An employee of the ACLU says: Over the past three years, it has become clear that the government often performs legal acrobatics in order to justify surveillance that was never authorized by Congress in the first place. Such acrobatics appear to extend to the NSA’s “Upstream surveillance,” which it operates under Section 702. ( https://www.justsecurity.org/29161/questions-congress-section-702/ ) Perhaps Neema Singh Guliani is simply not representing the ACLU properly, afterall the ACLU sued the government over FISA on the grounds it would intercept privileged communications. ( https://en.wikipedia.org/w/index.php?title=Foreign_Intelligence_Surveillanc… ). The same law granted retroactive immunity to telecommunications companies, authorizing their complicity in warrantless wiretapping. But then again, the ACLU isn't simply a legal aid organization, Ben Wizner is acting as a secretary for Snowden, assisting him in setting up videoconferences. And there's no legal acrobatics involved in that conclusion. Maybe a journalist will contact me after I post this, to which I won't respond for one of two reasons: you're complicit and you're aware, or you have failed to engage in an investigative followup, the type you like to second guess the police about. I do think this is an opportunity for our members of Congress to start a joint committee to investigate. Naturally I won't testify unless I'm given immunity, but I'm also willing to waive all legal liability against any party willing to testify before Congress if I'm granted immunity. I only desire the truth.

4 4

Fwd: [tor-talk] Cicada 3301: 2016
by grarpamp 09 Feb '16

09 Feb '16

---------- Forwarded message ---------- From: Jonathan Wilkes <jancsika(a)yahoo.com> Date: Tue, Feb 9, 2016 at 3:29 PM Subject: Re: [tor-talk] Cicada 3301: 2016 To: "tor-talk(a)lists.torproject.org" <tor-talk(a)lists.torproject.org> > I suspect that Cicada 3301 is run by some old-time cypherpunks looking for more people who are interested in building and deploying tech and not just posting to a mailing list. That seems odd, but then I don't know much about old-time cypherpunk ethos. Anyhow, are there examples of quality open source software built using this "secret cathedral" approach? -Jonathan On Tuesday, February 9, 2016 1:37 PM, The Doctor <drwho(a)virtadpt.net> wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Mon, 08 Feb 2016 22:13:10 +0000 Sean Lynch <seanl(a)literati.org> wrote: > I'm surprised anyone thinks this could possibly be anything besides a viral > marketing campaign. AR games are all the rage these days. Some AR games are run for fun and not as advertising (White Roses and Whence Comes the Time come immediately to mind). I suspect that Cicada 3301 is run by some old-time cypherpunks looking for more people who are interested in building and deploying tech and not just posting to a mailing list. The problems are way too technical for it to be 'just' an ARG. - -- The Doctor [412/724/301/703/415] [ZS] PGP: 0x807B17C1 / 7960 1CDC 85C9 0B63 8D9F DD89 3BD8 FF2B 807B 17C1 WWW: https://drwho.virtadpt.net/ Being wrong is not the same as lying. -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJWujIFAAoJED1np1pUQ8RkZ1QP/3o2nNmJsLBCjdMOXfzLaf+d M/aYXGpAvPJWg8atJAnu0iZNlyj4gtHJtGVRGtUgj31PfRaIUS4SLxlPm2862JF/ WSatYV6VRBg3b7gGHtyaMNuqaOciotwWsxoZb8o9GJE3krZKEZSHcbOKg0Vzu2MZ Vn6s8Q0Vyp6NGJkl7etHyCPiXU38lOx52PyaP579Q4KuSF2Zm8XMmo8fHSSqsbxx ++GJkHcVzZZoAPZE0YrTbWzsha76JoYiBbxWR4zmEjPDJTTpL+kNcujb7qcusO+q 09dnWY3+SxZwgRp1uxDg26C1pH8FQYWTRdebY0z58k0i/sEvKn7nQLoKl47h96B9 lP56/QIFPLZ77Iz9hZKHE9Dh1NkVGLanqCpVWN1twlf38iZhhM/I+lg5SfFXECwS udFSzdUQJMBwQG8Fh0sFarwUtqh0CfEo5d/B22y4PqwvcRWV1ENa2CrIgDU0SjXX cASF/AuWsReYIqWnnkpCvmkfgdPEodUXobTF159EwFWxdJE9jDVMFAEYChHczw8h Iwapo7dXgICre407IPDdZA/MxxGPA6f0hYny+Jm+yV45zLv5GNOkv/y8vtLM8mkP VitLd6TOY5GJynUv6+q2EmFmtlC2gfZm0cB04R84TAgG29EyJc0GmKpjTpKIDC0I BQkBrzP0KvmkyIN3WehE =rNO6 -----END PGP SIGNATURE----- -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0