- cypherpunks - lists.cpunks.org

THE BOY WHO COULD CHANGE THE WORLD: THE WRITINGS OF AARON SWARTZ by Aaron SwartzThe New Press
by coderman 31 Dec '15

31 Dec '15

https://newrepublic.com/article/126674/reading-everything-aaron-swartz-wrote ''' ... In a way, Aaron is a cautionary tale for unschooling. One of the lessons that school teaches is that the people who make the rules don’t really have to follow them. It’s something even the most rebellious students learn one way or another, but Aaron looked up a different set of rules and hacked his way out of school instead. On one hand Aaron was happy with his choice and felt more engaged and happier with online peers, on the other he absorbed a dangerous lesson about navigating bureaucratic systems. Plenty of legal scholars and technology experts thought Aaron had kept on the right side of the letter of the law, but the criminal justice system is resistant to the kind of hacking he tended to practice. I don’t know if he considered fleeing the country, but I doubt it. Maybe if he had lived to see Edward Snowden make dodging extradition look good, things would have been different. I was surprised when I saw the security footage of Aaron entering the MIT building, his bike helmet held half-heartedly in front of his face, his telltale hair poking out the sides. I had read the Manifesto, but I didn’t think it really reflected Aaron’s intentions. I was worried about what could happen to him, but not that worried. I figured he had enough institutional support to keep his punishment to a slap on the wrist. Mostly I was angry that he hadn’t taken what he was doing seriously enough; with a team and a little bit of planning, there’s no reason the authorities should have been able to tie Aaron to the action. But covert ops wasn’t one of his strengths, and he never got the chance to learn. If I’m part of the we that counted on Aaron, then I’m also part of the we that failed him. I thought his connections and credibility and reputation would keep him safe, and maybe he did too. Maybe we convinced him that a boy like him could change the world, or at least always hack an escape route. But there’s no individual who can’t be picked off if they cross the wrong line, or just the wrong prosecutor. '''

2 2

Re: [Cryptography] Understanding state can be important.
by grarpamp 30 Dec '15

30 Dec '15

On Tue, Dec 29, 2015 at 1:34 PM, Ray Dillinger <bear(a)sonic.net> wrote: > > On 12/28/2015 02:02 PM, Henry Baker wrote: >> At 11:45 AM 12/28/2015, Ray Dillinger wrote: >>> Maybe I've always been a suspicious bastard where software is concerned >> >> Apparently, not suspicious enough. >> >> It's nine o'clock; do you know what all of your processes (i.e., ps ax or equivalent) are doing? > > Oh hell no, there's hundreds of running processes now. I'm still a > suspicious bastard, but these days I feel utterly helpless to do > anything about it. There is no practical alternative to complicated > OSes that start processes without permission and refuse to explain > what they are and why they're running. I look at my process table, > I see $NAME I don't recognize, I ask "man $NAME" and there is no > such documentation. One more mysterious thing that will crash my > system if I kill it but I have to look elsewhere to explain what it > is and why it's running. > >> If you're running Win10, a goodly amount of disk & net traffic has to do with surveilling you > > This is one of the reasons I don't. The other is that there is even > less explanation of what the hell is running, and you can't even get > the code to check what the hell it does. The minimal unix userland process count up to a basic window manager is about ten, with all remote network bindings for same closed. Learning unix is essential for those who want to do that. BSD's usually have fewer layers of crap installed by default and are generally more discrete, thus easier to minimize than Linux's. As in this thread, minimization is only part of security.

1 0

Datasets mapping the internet
by Michael Best 29 Dec '15

29 Dec '15

https://archive.org/details/internet-mapping Includes datasets on Internet and DNS censuses, vulnerability scans, sets focused on specific weaknesses, sets focused on specific events (i.e. Hurricane Sandy), and ecosystems for encryption protocols, and modeling the strengths and weaknesses of the internet. Potentially useful for large scale data analysis and things I'm not clever enough tech savvy enough to figure out. More should be added next year, but for now I'm focused on finishing uploading and organizing the CIA files <http://that1archive.neocities.org/subfolder1/early-cia.html>. Enjoy or ignore. --Mike

1 0

Military porn (in words)
by Zenaan Harkness 29 Dec '15

29 Dec '15

Those not interested - look away. Interested in Russia's capabilities? This innocent little URL may be of interest. http://russia-insider.com/en/politics/you-want-war-russia-ready-war/ri11882 By Pepe Escobar, a playful writer if ever there was one. Enjoy :) Z

8 12

Re: Military porn (in words)
by Александр 29 Dec '15

29 Dec '15

> > net_kitteh(a)riseup.net wrote: > > The Russian government supports the violent murder of the LGBT+ community. > Its not propaganda at all. > > > http://www.pinknews.co.uk/2014/02/07/the-25-most-shocking-anti-gay-stories-… > > http://www.slate.com/blogs/outward/2014/01/30/gay_russia_under_putin_brutal… > > http://76crimes.com/100s-die-in-homophobic-anti-gay-attacks-statistics-upda… > > http://www.advocate.com/news/world-news/2014/02/03/3-russians-convicted-bru… > > http://www.vocativ.com/world/russia/brutal-anti-gay-murder-in-russia-shines… > https://www.rt.com/news/man-killed-homophobia-russia-198/ > http://www.reuters.com/article/us-russia-gay-idUSBRE94C0AX20130513 > > http://www.pinknews.co.uk/2013/08/08/the-20-most-shocking-anti-gay-news-sto… > > http://www.independent.co.uk/news/world/europe/russia-homophobic-murder-two… > > www.washingtonblade.com/2015/02/28/russia-propaganda-law-created-army-anti-… > > https://www.youtube.com/watch?feature=player_embedded&v=QYzccu5tn7A > https://www.youtube.com/watch?v=JdnqTn74fXA > > is ALL of this just propaganda? > news articles, some of them from Russia themselves, show a much darker > side to your idealistic portrayal of Russia. > Seriously, FUCK Russia. > ____ is ALL of this just propaganda? > news articles, some of them from Russia themselves > Yes it is. 90% of it is a cheap and rubbish propaganda. And if you didn't know, in Russia itself, there are A LOT of "bought" journalists & media channels by the west. The Russian government supports the violent murder of the LGBT+ community. I think one could not say/write in more stupid way something about the Russian government. It supports "violent" murder ONLY of terrorists and soldiers from the armies of aggressors who invade in its sovereign land (Napoleon, Hitler etc.). As for the objective reality > (https://www.rt.com/news/man-killed-homophobia-russia-198/) > There are indeed some murder cases of LGBT people in Russia every year. But if you didn't know, *in EVERY country* there are cases when somebody get killed out of all kind of reasons (including homophobia) . And one CAN NOT say it is the "government policy" because there are some freaky pedophiles/xenophobes/homophobes... in the country. Their percentage is insignificant and not more than in the same greaat and bOOOld democratic US. So, cut off your bullshit and stop whining. Seriously, FUCK Russia. > *And seriously, FUCK YOU.*

3 3

OTR FP 023255B5 5B390F33 F0171191 A9AD7ED1 A3FD2CBE [was Re: 0x962B3498EDF0A585-coder.pub.txt]
by coderman 29 Dec '15

29 Dec '15

1 0

US Gov TSA to the People: Papers Please
by grarpamp 29 Dec '15

29 Dec '15

http://yro.slashdot.org/story/15/12/28/2132237/tsa-moves-closer-to-rejectin… Jad Mouawad writes at the NYT that a driver's license may no longer be enough for airline passengers to clear security in some states... https://en.wikipedia.org/wiki/REAL_ID_Act http://papersplease.org/

2 1

Re: [Cryptography] Understanding state can be important.
by grarpamp 29 Dec '15

29 Dec '15

On Mon, Dec 28, 2015 at 2:45 PM, Ray Dillinger <bear(a)sonic.net> wrote: [look it up on metzdowd] > There is no physical basis for security we're truly certain of > to even be built any more. > > And we allowed it to happen. Cry baby cry. Yet whenever anyone suggests actually exploring parameters (you know, doing work) of potential solutions such as open fabs... it's all omg, cost, and we're stupid it's impossible, followed by crickets. Baby is as baby does.

2 1

TheCthulhu / CthulhuSec to Cryptome
by Michael Best 29 Dec '15

29 Dec '15

I'm curious what everyone thinks. I personally agree with TheCthulhu, but I'm not a tech or crypto expert. Original: https://www.thecthulhu.com/a-response-to-cryptome/ So today (20th December) I posted a mirror of the Cryptome archive I received from a close associate of mine (of whom I trust greatly) and was met by a rather blunt response from the Cryptome administrators regarding the integrity of the data I host. As many know, I take the subject of tampering very seriously, and whenever I have leaked or shared data I strive to provide it with a SHA1 and SHA256 hash at a minimum and also provide torrents, HTTPS and onion download options. Furthermore, if ever asked, I would also sign files using my personal PGP key. [image: 7fc92ced0b91c71560dcdc251bc2a0d9] <https://www.thecthulhu.com/wp-content/uploads/7fc92ced0b91c71560dcdc251bc2a…> The response I received from Cryptome was also either hinting that the entire research and crypto community is wrong in their conclusions, or that the Cryptome administrators don’t understand it themselves. The assumption that cryptography is unbreakable assuming an adversary with unlimited resources is wrong, even an adversary with limited resources given enough time can break all cryptography, but that doesn’t make it anything other than a theoretical matter when put into the actual context. This statement in particular “Mirroring is tampering. We ask that mirrors be labeled as tampering.” really also irritates me. If Cryptome is so concerned that data is being tampered with, I suggest the following: 1. An MD5, SHA1, SHA256, SHA512 and Whirlpool digest be produced for the full archive of files in a format such as .zip or .tar. 2. The Cryptome administrators sign all the digests in a single PGP message to verify the hashes match the archive they produced. 3. The PGP signed message is published with the digests for 14 days on the Cryptome website, Twitter, my Twitter, my blog and any other source who wishes to make a copy of it. The 14 day period allows time for any party to raise concerns if say for example, a third party had stolen the PGP keys to forge the signature then the Cryptome administrators should have had time to realise this and either revoke the key or in some way suggest the archive is not legitimate. 4. After the 14 day period, the archive is made available publicly to which I shall ensure the hashes can be reproduced on my end, and then I will also sign the digests message to say it is the one I received and will be mirroring. 5. A torrent file can be produced which downloads the archive file specified above; this can also be signed by myself and Cryptome so people can be sure it is the one we intended to distribute and another layer of checks by checking the hash once downloaded exists. 6. External parties such as Twitter followings, security researchers etc cross sign the digests and our keys if they know us sufficiently and trust the archive is true as it was intended to be distributed. If the above procedure is not sufficiently secure, then one must operate on the assumption all technology is unsafe to use. There is the legitimate concern of hardware tampering and backdoors, which is why open source software should be used at all stages. However, I would like to draw attention to the fact that Cryptome offers the full archive for $100 which is shipped via USB. Therefore, concerns regarding hash or cryptographic security yet readily shipping USBs seems to me a fairly extreme state of cognitive dissonance given what is known about attacks like BadUSB and state physical interception operations. I call on Cryptome to start allowing proper mirroring of content. Nobody has called upon Cryptome to host the content themselves or in any way incur additional costs. What is being asked is that you provide the content with reasonable security as I propose above, rather than completely ignoring the matter which will drastically reduce the security and safety of downloads. If you claim to be all about anti-censorship and transparency, then the measures I propose above are a good fit. This isn’t about offering 100% perfect security, this is about offering people the ability to verify the files in a manner which is reasonable and proportionate to the technology even state level adversaries currently possess. Even if you disagree on the security of the cryptographic protocols and measures I describe above, know that the vast majority of researchers and information security professionals disagree with you, and that providing it is still far better than not providing the hashes at all.

6 6

Seeking Anonymity in an Internet Panopticon - collective anonymity vs. individualized anonymity
by coderman 29 Dec '15

29 Dec '15

https://cryptome.org/2015/12/anon-v-panopticon.pdf ''' We believe the vulnerabilities and measurability limitations of onion routing may stem from an attempt to achieve an impossible set of goals and to defend an ultimately indefensible position. Current tools offer a general-purpose, unconstrained, and individualistic form of anonymous Internet access. However, there are many ways for unconstrained, individualistic uses of the Internet to be fingerprinted and tied to individual users. We suspect that the only way to achieve measurable and provable levels of anonymity, and to stake out a position defensible in the long term, is to develop more collective anonymity protocols and tools. It may be necessary to constrain the normally individualistic behaviors of participating nodes, the expectations of users, and possibly the set of applications and usage models to which these protocols and tools apply. Toward this end, we offer a high-level view of the Dissent project, a “clean-slate” effort to build practical anonymity systems embodying a collective model for anonymous communication. '''

1 0