- cypherpunks - lists.cpunks.org

More on political correctness gone mad - The Saker - why i use the term anglozionist and why its important
by Zenaan Harkness 07 Feb '16

07 Feb '16

OK, I'm going to take the /dev/zero redirections. This article is rational, as far as I can tell, but hey, my powers of ascertaining rationality may well not match yours. I say this is on-topic regarding the political correctness gone mad discussions. On topic as in, bang on topic. But to limit the fallout from posting such filth, here's just the link: http://russia-insider.com/en/politics/why-i-use-term-anglozionist-and-why-i… Trigger words used - anglozionist and plenty more, so if that's not for you plug your ears now, cover your eyes and fuck off to your cotton wool world.

1 0

Re: Self Preservation and Irreversible Decline [was: Electronic Freedom Foundation selective in support of freedom]
by Zenaan Harkness 07 Feb '16

07 Feb '16

This one got lost to the wrong reply button, and I have an addition now too... On 1/17/16, Zenaan Harkness <zen(a)freedbms.net> wrote: > On 1/17/16, coderman <coderman(a)gmail.com> wrote: >> On 1/15/16, Zenaan Harkness <zen(a)freedbms.net> wrote: >>> ... >>> I guess that's the ultimate propaganda success really - not being >>> aware that your country is always at war, and pretty much always has >>> been. War is the ultimate rejection and domination of the sovereignty >>> of other nations and individuals. >> >> next question: >> can you have nation states without war? > > That would require a truly benevolent 'dictator' at the top ... Gandhi > when prime minister of India was shot by one of his own security > guards, the Israeli prime minister who got in on a "peace with > Palestinians" platform some years back got shot (by an Israeli), the > only two US presidents who (attempted to) print greenbacks rather than > borrow from the banks (i.e. reclaim the government's constitutional > money power), got shot, ... > > the odds for such leaders don't look so good... > > On the other hand, Iceland has jailed at least 26 bankers so far: > http://www.independent.co.uk/voices/iceland-has-jailed-26-bankers-why-wont-… > > so perhaps there's hope... they ousted two full parliaments to get > there though, to full new elections and finally a year(?) long > population-wide new constitution creation which on the face of it > appears to be genuinely by the people themselves, and also clearly > -for- themselves, having rejected any bail-in or bail-out for the > failed commercial private banks that brought that country to its > financial knees. > > Seems a genuinely community-based groundswell is needed for genuinely > 'good' change, if nothing else... In iceland, some portion of mortgage debts were forgiven also: "Reports from 2012 (many of which were written by U.S. media outlets) noted that while Iceland forgave a large amount of mortgage debt in order to boost the economy's recovery from a financial crisis, this action did not entail entirely wiping out all home mortgages held by all citizens of Iceland. Rather, it involved forgiving a portion of some mortgage debt that was tied to inflation:" http://www.snopes.com/iceland-debt-forgiveness/ Sad thing is, a great story got bullshitted by sensationalist crap news, and so Snopes has a field day saying how false it all is, although they do provide the above quoted paragraph to their credit.

1 0

Re: [tor-talk] Using SDR
by coderman 06 Feb '16

06 Feb '16

On 2/5/16, Sean Lynch <seanl(a)literati.org> wrote: > ... Radio is being used right now to provide anonymity, but it's being used[1] > to hide endpoints similar to the duct-taped payphone trick depicted in > Hackers, in order to avoid attacks like the one used to capture Ross > Ulbricht without giving him a chance to wipe his computer (they snuck up > behind him and pinned his arms, but they would have just rushed him had > that not been possible). If you use a device like the ProxyHam and you sit > somewhere where you can see it, there's a reasonable chance you'd spot > someone who's trying to find you, giving you a chance to hit your panic > button and escape. this assumes you're keeping it under constant supervision, of course :P > The older, lower-tech version of this trick is to use a high-gain antenna > like the Cantenna or a Yagi to use a public wifi AP from a stealthy, > defensible location. The problem with this is that this presents no > challenge to RDF (radio direction finding) equipment designed for WiFi. > That's the big advantage of the ProxyHam, since whoever is looking for you > probably won't know in advance what frequency you're using. And solving > that problem in a general way requires MUCH more expensive gear than just > locating WiFi clients. one of my favorite tricks, but rather rude in spectrum, is setting high power amplifier to maximum. DF tends to see this signal arriving from all around... *grin* this introduces it's own trade-offs, of course. > If you're concerned about someone coming after you with much more capable > RDF equipment, you are now talking about LPI (low probability of intercept) > communications. This could be something as simple as a longwave infrared > optical link, which won't show up on regular CCD or CMOS camera even > without an IR filter. free space optics rides again!! :P > With SDR you might use some form of non-sinusoidal > spread spectrum with extremely high processing gain so you'll be well below > the noise floor and your carrier won't be recoverable using autocorrelation > techniques. Some UWB techniques fall into this category, though because > "legal" UWB is required to be confined to a narrower bandwidth, it's > probably detectable. right, UWB is the solution here with privacy and authenticity at the physical layer (not above MAC, or other deferred placement in stack) > It MAY be possible to use SDR to achieve LPI while still remaining within if you're building LPI, you don't give a fuck about the FCC (compliance). by definition, if they've found you, you fucked up! > Actually, that gives me an idea: MIMO precoding[2] (versus spatial > multiplexing, which is useless for your purposes). MIMO precoding devolves > to beam-forming in the absence of reflectors like buildings, but in an > urban environment, you get a complex combination of signal paths, > > MIMO precoding requires a "training" phase where they discover one another > by transmitting some easily "locked-onto" signal so that each receiver can > find the other transmitter independently. it is now possible for a professional's budget to accodomate the SDR equipment necessary to do this type of phase sync'ed active beam forming MIMO transmission, and not all methods require the training phase. in fact, omission of this (by out of band training, in a sense) in a method of "keying" phased delivery of UWB MIMO in a way more likely to achieve LPI. synthetic aperature millimeter wave vision systems are also pushing along this boundary, for cross-pollination of suitable phased sync'ed UWB MIMO signal processing. i could go on, if you're curious, but perhaps on another list? :) best regards,

3 4

Fwd: Arc of history; ultimate vindication
by coderman 06 Feb '16

06 Feb '16

"Both the journal and the documents she obtained from the government show how her own targeting helped to galvanize her resolve to expose the apparatus of surveillance." they've made fatal errors; miscalculating the blow back of global privacy destruction. against such injustice, some will spend every life hour left in opposition to this moral atrocity. "Nope, Never. Fuck NO!" best regards, --- http://www.wired.com/2016/02/snowdens-chronicler-reveals-her-own-life-under… Snowden’s Chronicler Reveals Her Own Life Under Surveillance Andy Greenberg Security Date of Publication: 02.04.16. 02.04.16 Time of Publication: 9:03 am. 9:03 am Laura Poitras has a talent for disappearing. In her early documentaries like My Country, My Country and The Oath, her camera seems to float invisibly in rooms where subjects carry on intimate conversations as if they’re not being observed. Even in Citizenfour, the Oscar-winning film that tracks her personal journey from first contact with Edward Snowden to releasing his top secret NSA leaks to the world, she rarely offers a word of narration. She appears in that film exactly once, caught as if by accident in the mirror of Snowden’s Hong Kong hotel room. Now, with the opening of her multi-media solo exhibit, Astro Noise, at New York’s Whitney Museum of American Art this week, Snowden’s chronicler has finally turned her lens onto herself. And she’s given us a glimpse into one of the darkest stretches of her life, when she wasn’t yet the revelator of modern American surveillance but instead its target. The exhibit is vast and unsettling, ranging from films to documents that can be viewed only through wooden slits to a video expanse of Yemeni sky which visitors are invited to lie beneath. But the most personal parts of the show are documents that lay bare how excruciating life was for Poitras as a target of government surveillance—and how her subsequent paranoia made her the ideal collaborator in Snowden’s mission to expose America’s surveillance state. First, she’s installed a wall of papers that she received in response to an ongoing Freedom of Information lawsuit the Electronic Frontier Foundation filed on her behalf against the FBI. The documents definitively show why Poitras was tracked and repeatedly searched at the US border for years, and even that she was the subject of a grand jury investigation. And second, a book she’s publishing to accompany the exhibit includes her journal from the height of that surveillance, recording her first-person experience of becoming a spying subject, along with her inner monologue as she first corresponded with the secret NSA leaker she then knew only as “Citizenfour.” Poitras says she initially intended to use only a few quotes from her journal in that book. But as she was transcribing it, she “realized that it was a primary source document about navigating a certain reality,” she says. The finished book, which includes a biographical piece by Guantanamo detainee Lakhdar Boumediene, a photo collection from Ai Weiwei, and a short essay by Snowden on using radio waves from stars to generate random data for encryption, is subtitled “A Survival Guide for Living Under Total Surveillance.” It will be published widely on February 23. “I’ve asked people for a long time to reveal a lot in my films,” Poitras says. But telling her own story, even in limited glimpses, “provides a concrete example of how the process works we don’t usually see.” That process, for Poitras, is the experience of being unwittingly ingested into the American surveillance system. On the Government’s Radar Poitras has long suspected that her targeting began after she filmed an Iraqi family in Baghdad for the documentary My Country, My Country. Now she’s sure, because the documents released by her Freedom of Information Act request prove it. During a 2004 ambush by Iraqi insurgents in which an American soldier died and several others were injured, she came out onto the roof of the family’s home to film them as they watched events unfolding on the street below. She shot for a total of eight minutes and 16 seconds. The resulting footage, which she shows in the Whitney exhibit, reveals nothing related to either American or insurgent military positions. “Those eight minutes changed my life, though I didn’t know it at the time,” she says in an audio narration that plays around the documents in her exhibition. “After returning to the United States I was placed on a government watchlist and detained and searched every time I crossed the US border. It took me ten years to find out why.” laura-poitras-whitneyClick to Open Overlay Gallery A Whitney Museum visitor looking at a selection of Poitras’ FOIAed documents framed in a collection of light boxes. Andy Greenberg The heavily redacted documents show that the US Army Criminal Investigation Command requested in 2006 that the FBI investigate Poitras as a possible “U.S. media representative … involved with anti-coalition forces.” According to the FBI file, a member of the Oregon National Guard serving in Iraq identified Poitras and “a local [Iraqi] leader”—the father of the family that would become the subject of her film. The soldier, whose name was redacted, questioned Poitras at the time, and reported that she “became significantly nervous” and denied filming from the roof. He later told the Army investigators that he “strongly believed”—but without apparent evidence—“POITRAS had prior knowledge of the ambush and had the means to report it to U.S. Forces; however, she purposely did not report it so she could film the attack for her documentary.” One page shown in the Whitney exhibit reveals that the New York field office of the FBI was tracking Poitras’ home addresses, and Poitras believes the reference to a “detective” working with the FBI indicates the New York Police Department may have also been involved. By 2007, the documents reveal that there was a grand jury investigation proceeding on whether to indict her for unnamed crimes—multiple subpoenas sought information about her from redacted sources. (Poitras says that the twelve pages she published in the Whitney exhibition are only a selection of 800 documents she’s received in her FOIA lawsuit, which is ongoing.) Being Constantly Watched Private as ever, Poitras declined to detail to WIRED exactly how she experienced that federal investigation in the years that followed. But flash forward to late 2012, and the surveillance targeting Poitras had transformed her into a nervous wreck. In the book, she shares a diary she kept during her time living in Berlin, in which she describes feeling constantly watched, entirely robbed of privacy. “I haven’t written in over a year for fear these words are not private,” are the journal’s first words. “That nothing in my life can be kept private.” She sleeps badly, plagued with nightmares about the American government. She reads Cory Doctorow’s Homeland and re-reads 1984, finding too many parallels with her own life. She notes her computer glitching and “going pink” during her interviews with NSA whistleblower William Binney, and that it tells her its hard drive is full despite seeming to have 16 gigabytes free. Eventually she moves to a new apartment that she attempts to keep “off the radar” by avoiding all cell phones and only accessing the Internet over the anonymity software Tor. When Snowden contacts her in January of 2013, Poitras has lived with the specter of spying long enough that she initially wonders if he might be part of a plan to entrap her or her contacts like Julian Assange or Jacob Appelbaum, an activist and Tor developer. “Is C4 a trap?” she asks herself, using an abbreviation of Snowden’s codename. “Will he put me in prison?” Even once she decides he’s a legitimate source, the pressure threatens to overwhelm her. The stress becomes visceral: She writes that she feels like she’s “underwater” and that she can hear the blood rushing through her body. “I am battling with my nervous system,” she writes. “It doesn’t let me rest or sleep. Eye twitches, clenched throat, and now literally waiting to be raided.” Finally she decides to meet Snowden and to publish his top secret leaks, despite her fears of both the risks to him and to herself. Both the journal and the documents she obtained from the government show how her own targeting helped to galvanize her resolve to expose the apparatus of surveillance. “He is prepared for the consequences of the disclosure,” she writes, then admits: “I really don’t want to become the story.” In the end, Poitras has not only escaped the arrest or indictment she feared, but has become a kind of privacy folk hero: Her work has helped to noticeably shift the world’s view of government spying, led to legislation, and won both a Pulitzer and an Academy Award. But if her ultimate fear was to “become the story,” her latest revelations show that’s a fate she can no longer escape–and one she’s come to accept. Poitras’ Astro Noise exhibit runs from February 5 until May 1 at the Whitney Museum of American Art, and the accompanying book will be published on February 23.

2 1

Looks like DHS sabotaged a FOIA request on Cryptome
by Michael Best 06 Feb '16

06 Feb '16

I filed a FOIA request about Cryptome with DHS a while back: Any records relating to Cryptome, also known by its web address of > Cryptome.org, which posts pictures of sensitive sites and potential > security holes as described at > www.nytimes.com/2004/08/29/nyregion/mapping-natural-gas-lines-advise-the-pu… > by the New York Times. https://www.muckrock.com/foi/united-states-of-america-10/cryptome-dhs-22647/ Sent through MuckRock on December 1, acknowledged on December 2. Also closed on December 2, according to the DHS FOIA website. No notification or explanation provided, not through MuckRock or to me directly. I say to me directly because they also closed another FOIA of mine without explanation, insisting on opening a new one when I tried to follow up within the 30 days. http://www.dhs.gov/foia-status FOIA # *2016-HQFO-00099* Weird, right?

2 2

Article: going post quantum
by Cari Machet 05 Feb '16

05 Feb '16

http://www.miracl.com/blog/going-post-quantum

1 0

Tacit Futures: Building Snowden Archives (with Cryptome)
by Michael Best 05 Feb '16

05 Feb '16

Audio only: https://voicerepublic.com/talks/tacit-futures-1-building-snowden-archives Anyone know of a video source? Today, WikiLeaks is building an unprecedented library consisting of millions of leaked documents, thereby advancing a seminal world heritage form. Its immediate prehistory as well as its latest offspring will be investigated in the *Tacit Futures* dialogues. Participants will explore Cryptome.org, which is widely considered the precursor of digital leaking platforms, and which has been the first organization to start systematically collecting Snowden documents. Moreover the discussion will dive into projects building Snowden archives such as the Snowden Document Search, the Snowden Digital Surveillance Archive, and the Snowden Archive-in-a-Box. Bringing together pioneering archivists of the files leaked by Snowden, this round table is a culturally significant world premiere, aiming to reflect the motivations and challenges experienced by each initiative. *Tacit Futures: Diving Into Snowden Archives* is the follow-up to UN|COMMONS and a cooperation between Berliner Gazette and transmediale in the context of the Tacit Futures project by Berliner Gazette <http://berlinergazette.de/feuilleton/jahresthemen/2016-tacit-futures/>.

1 0

Re: request for comment re "contributor-covenant.org"
by shakeitoff＠ghostmail.com 05 Feb '16

05 Feb '16

>> Genuinely anti-social communication is actively discouraged, and this includes >> those who communicate deceptively regarding their own needs and or social >>environment requirements, as well as those who communicate in a passive >> aggressive way. If you this any of these types of communication may apply to >> you, then be prepared to suffer the consequences should you join this mailing >> list- we shall roast you in words, with glee! Why doesn't the gleeful roasting extend to the bigotry and chauvinism on this list? Why are these silently accepted? Cypherpunks defines government as “a home for bullies masquerading as a collective defense.” Interestingly, that is how I would describe your above approach. Be careful of becoming the oppressor. Look around. Do the people around you look like you? Think like you? Come from the same background as you? This is a problem. The lack of diversity in this group is not a magical phenomenon without a root cause. There is a deeper problem. If (and how) this should change is up to this community. Sadly, the ideals of this community are often lost in the (typically incoherent) bigotry spewing from the trolls. 4.12.4. "Crypto Anarchy sounds too wild for me." - I accept that many people will find the implications of crypto anarchy (which follows in turn from the existence of strong cryptography, via the Crypto Anarchy Principle) to be more than they can accept. - This is OK (not that you need my OK!). The house of Cypherpunks has many rooms. All are welcome. I hope. >> There are forums and mailing lists which are suitable for those who have >> learning difficulties (reference?), for those who need an emotionally sensitive >> environment (be sure to check if you need professional medical or >> psychological support), and for those who are beginniners in the field of >> technology discussed on this mailing list. Wow. How fucking elitist can you be? Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

7 6

Re: request for comment re &quot;contributor-covenant.org&quot;
by shakeitoff＠ghostmail.com 05 Feb '16

05 Feb '16

>> Cypherpunks defines government as “a home for bullies masquerading as a >> collective defense.” Interestingly, that is how I would describe your above >> approach. > These two sentences are approaching incoherent. Would you like to try > again? It is probably not constructive for me to respond to > incoherence - there is perhaps some truth or pain or seeking which has > not been expressed clearly, which I would hope you feel confident > about expressing, or re- attempting to express - such is in our > collective interests. The main worry is when “gleeful roasting” slips into bullying and irreversible harm. It's easy for a collective group to shout someone out for the wrong reasons. Censorship is not the answer to this. But having plain, honest, thoughtful conversations might be. >> Look around. Do the people around you look like you? Think like you? Come >> from the same background as you? > >> This is a problem. > So say you. > Making you assertion is presently an island waiting for supporters - > nothing more than a political position in search of part members. This > is not the place for such superficiality. I personally seek deeper > conversation. If you create an environment that is conducive to only one socioeconomic class, you lose individuals who are strong technologists, but whom don’t fit a certain race/gender/economic profile. It is a loss for the community when strong technologists leave because they do not fit the socioeconomic culture of the majority. Especially when considering what this group is fundamentally trying to resist. >From my own personal experience- when a group is diverse, one’s own race/gender/economic background matters less and fades into the background. This is the ideal- to not even have to talk/think about socioeconomic issues, and focus on common issues- on how to reverse the end of privacy, on writing code, on ensuring strong cryptography. > Do you assert that you would like a particular communication space to > exist, which does not currently exist, but which is somehow similar to > cypherpunks mailing list, but perhaps a little different? No, there is nothing begrudging. I’m here because I want to be useful to ensure that privacy and personal liberty and privacy continue to exist. And to learn. This is the ask: don’t let this be a space where someone has to struggle between alignment to the cypherpunks ideology (writing code, ensuring privacy and liberty, preserving cryptography) and alienation because of one’s socioeconomic background. Also, let us not forget who the real enemy is. Thank you. Sent from secure GhostMail. Easy and free encrypted email, chat and cloud storage, free sign up here: https://www.ghostmail.com

4 5

Fwd: [tor-talk] Tor 0.2.8.1-alpha is released.
by coderman 05 Feb '16

05 Feb '16

good stuff in: Major features (security, Linux), and Major features (directory system), for those in challenging environments... :P best regards, > ---------- Forwarded message ---------- > From: Nick Mathewson <nickm(a)torproject.org> > Date: Thu, 4 Feb 2016 18:24:03 -0500 > Subject: [tor-talk] Tor 0.2.8.1-alpha is released. > > Tor 0.2.8.1-alpha is the first alpha release in its series. It > includes numerous small features and bugfixes against previous Tor > versions, and numerous small infrastructure improvements. The most > notable features are a set of improvements to the directory subsystem. > > You can download the source from the usual place on the website. > Packages should be available over the next several days. > > PLEASE NOTE: This is an alpha release. Expect a lot of bugs. Only > run this release if you're willing to find bugs and report them. :) > > Changes in version 0.2.8.1-alpha - 2016-02-04 > Tor 0.2.8.1-alpha is the first alpha release in its series. It > includes numerous small features and bugfixes against previous Tor > versions, and numerous small infrastructure improvements. The most > notable features are a set of improvements to the directory subsystem. > > o Major features (security, Linux): > - When Tor starts as root on Linux and is told to switch user ID, it > can now retain the capability to bind to low ports. By default, > Tor will do this only when it's switching user ID and some low > ports have been configured. You can change this behavior with the > new option KeepBindCapabilities. Closes ticket 8195. > > o Major features (directory system): > - When bootstrapping multiple consensus downloads at a time, use the > first one that starts downloading, and close the rest. This > reduces failures when authorities or fallback directories are slow > or down. Together with the code for feature 15775, this feature > should reduces failures due to fallback churn. Implements ticket > 4483. Patch by "teor". Implements IPv4 portions of proposal 210 by > "mikeperry" and "teor". > - Include a trial list of default fallback directories, based on an > opt-in survey of suitable relays. Doing this should make clients > bootstrap more quickly and reliably, and reduce the load on the > directory authorities. Closes ticket 15775. Patch by "teor". > Candidates identified using an OnionOO script by "weasel", "teor", > "gsathya", and "karsten". > - Previously only relays that explicitly opened a directory port > (DirPort) accepted directory requests from clients. Now all > relays, with and without a DirPort, accept and serve tunneled > directory requests that they receive through their ORPort. You can > disable this behavior using the new DirCache option. Closes > ticket 12538. > > o Major key updates: > - Update the V3 identity key for the dannenberg directory authority: > it was changed on 18 November 2015. Closes task 17906. Patch > by "teor". > > o Minor features (security, clock): > - Warn when the system clock appears to move back in time (when the > state file was last written in the future). Tor doesn't know that > consensuses have expired if the clock is in the past. Patch by > "teor". Implements ticket 17188. > > o Minor features (security, exit policies): > - ExitPolicyRejectPrivate now rejects more private addresses by > default. Specifically, it now rejects the relay's outbound bind > addresses (if configured), and the relay's configured port > addresses (such as ORPort and DirPort). Fixes bug 17027; bugfix on > 0.2.0.11-alpha. Patch by "teor". > > o Minor features (security, memory erasure): > - Set the unused entries in a smartlist to NULL. This helped catch > a (harmless) bug, and shouldn't affect performance too much. > Implements ticket 17026. > - Use SecureMemoryWipe() function to securely clean memory on > Windows. Previously we'd use OpenSSL's OPENSSL_cleanse() function. > Implements feature 17986. > - Use explicit_bzero or memset_s when present. Previously, we'd use > OpenSSL's OPENSSL_cleanse() function. Closes ticket 7419; patches > from <logan(a)hackers.mu> and <selven(a)hackers.mu>. > - Make memwipe() do nothing when passed a NULL pointer or buffer of > zero size. Check size argument to memwipe() for underflow. Fixes > bug 18089; bugfix on 0.2.3.25 and 0.2.4.6-alpha. Reported by "gk", > patch by "teor". > > o Minor features (security, RNG): > - Adjust Tor's use of OpenSSL's RNG APIs so that they absolutely, > positively are not allowed to fail. Previously we depended on > internal details of OpenSSL's behavior. Closes ticket 17686. > - Never use the system entropy output directly for anything besides > seeding the PRNG. When we want to generate important keys, instead > of using system entropy directly, we now hash it with the PRNG > stream. This may help resist certain attacks based on broken OS > entropy implementations. Closes part of ticket 17694. > - Use modern system calls (like getentropy() or getrandom()) to > generate strong entropy on platforms that have them. Closes > ticket 13696. > > o Minor features (accounting): > - Added two modes to the AccountingRule option: One for limiting > only the number of bytes sent ("AccountingRule out"), and one for > limiting only the number of bytes received ("AccountingRule in"). > Closes ticket 15989; patch from "unixninja92". > > o Minor features (build): > - Since our build process now uses "make distcheck", we no longer > force "make dist" to depend on "make check". Closes ticket 17893; > patch from "cypherpunks." > - Tor now builds successfully with the recent OpenSSL 1.1 > development branch, and with the latest LibreSSL. Closes tickets > 17549, 17921, and 17984. > > o Minor features (controller): > - Adds the FallbackDir entries to 'GETINFO config/defaults'. Closes > tickets 16774 and 17817. Patch by George Tankersley. > - New 'GETINFO hs/service/desc/id/' command to retrieve a hidden > service descriptor from a service's local hidden service > descriptor cache. Closes ticket 14846. > - Add 'GETINFO exit-policy/reject-private/[default,relay]', so > controllers can examine the the reject rules added by > ExitPolicyRejectPrivate. This makes it easier for stem to display > exit policies. > > o Minor features (crypto): > - Add SHA512 support to crypto.c. Closes ticket 17663; patch from > George Tankersley. > - Add SHA3 and SHAKE support to crypto.c. Closes ticket 17783. > - When allocating a digest state object, allocate no more space than > we actually need. Previously, we would allocate as much space as > the state for the largest algorithm would need. This change saves > up to 672 bytes per circuit. Closes ticket 17796. > - Improve performance when hashing non-multiple of 8 sized buffers, > based on Andrew Moon's public domain SipHash-2-4 implementation. > Fixes bug 17544; bugfix on 0.2.5.3-alpha. > > o Minor features (directory downloads): > - Wait for busy authorities and fallback directories to become non- > busy when bootstrapping. (A similar change was made in 6c443e987d > for directory caches chosen from the consensus.) Closes ticket > 17864; patch by "teor". > - Add UseDefaultFallbackDirs, which enables any hard-coded fallback > directory mirrors. The default is 1; set it to 0 to disable > fallbacks. Implements ticket 17576. Patch by "teor". > > o Minor features (geoip): > - Update geoip and geoip6 to the January 5 2016 Maxmind GeoLite2 > Country database. > > o Minor features (IPv6): > - Add an argument 'ipv6=address:orport' to the DirAuthority and > FallbackDir torrc options, to specify an IPv6 address for an > authority or fallback directory. Add hard-coded ipv6 addresses for > directory authorities that have them. Closes ticket 17327; patch > from Nick Mathewson and "teor". > - Add address policy assume_action support for IPv6 addresses. > - Limit IPv6 mask bits to 128. > - Warn when comparing against an AF_UNSPEC address in a policy, it's > almost always a bug. Closes ticket 17863; patch by "teor". > - Allow users to configure directory authorities and fallback > directory servers with IPv6 addresses and ORPorts. Resolves > ticket 6027. > - routerset_parse now accepts IPv6 literal addresses. Fixes bug > 17060; bugfix on 0.2.1.3-alpha. Patch by "teor". > - Make tor_ersatz_socketpair work on IPv6-only systems. Fixes bug > 17638; bugfix on 0.0.2pre8. Patch by "teor". > > o Minor features (logging): > - When logging to syslog, allow a tag to be added to the syslog > identity (the string prepended to every log message). The tag can > be configured with SyslogIdentityTag and defaults to none. Setting > it to "foo" will cause logs to be tagged as "Tor-foo". Closes > ticket 17194. > > o Minor features (portability): > - Use timingsafe_memcmp() where available. Closes ticket 17944; > patch from <logan(a)hackers.mu>. > > o Minor features (relay, address discovery): > - Add a family argument to get_interface_addresses_raw() and > subfunctions to make network interface address interogation more > efficient. Now Tor can specifically ask for IPv4, IPv6 or both > types of interfaces from the operating system. Resolves > ticket 17950. > - When get_interface_address6_list(.,AF_UNSPEC,.) is called and > fails to enumerate interface addresses using the platform-specific > API, have it rely on the UDP socket fallback technique to try and > find out what IP addresses (both IPv4 and IPv6) our machine has. > Resolves ticket 17951. > > o Minor features (replay cache): > - The replay cache now uses SHA256 instead of SHA1. Implements > feature 8961. Patch by "teor", issue reported by "rransom". > > o Minor features (unix file permissions): > - Defer creation of Unix sockets until after setuid. This avoids > needing CAP_CHOWN and CAP_FOWNER when using systemd's > CapabilityBoundingSet, or chown and fowner when using SELinux. > Implements part of ticket 17562. Patch from Jamie Nguyen. > - If any directory created by Tor is marked as group readable, the > filesystem group is allowed to be either the default GID or the > root user. Allowing root to read the DataDirectory prevents the > need for CAP_READ_SEARCH when using systemd's > CapabilityBoundingSet, or dac_read_search when using SELinux. > Implements part of ticket 17562. Patch from Jamie Nguyen. > - Introduce a new DataDirectoryGroupReadable option. If it is set to > 1, the DataDirectory will be made readable by the default GID. > Implements part of ticket 17562. Patch from Jamie Nguyen. > > o Minor bugfixes (accounting): > - The max bandwidth when using 'AccountRule sum' is now correctly > logged. Fixes bug 18024; bugfix on 0.2.6.1-alpha. Patch > from "unixninja92". > > o Minor bugfixes (code correctness): > - When closing an entry connection, generate a warning if we should > have sent an end cell for it but we haven't. Fixes bug 17876; > bugfix on 0.2.3.2-alpha. > - Assert that allocated memory held by the reputation code is freed > according to its internal counters. Fixes bug 17753; bugfix > on tor-0.1.1.1-alpha. > - Assert when the TLS contexts fail to initialize. Fixes bug 17683; > bugfix on 0.0.6. > > o Minor bugfixes (compilation): > - Mark all object files that include micro-revision.i as depending > on it, so as to make parallel builds more reliable. Fixes bug > 17826; bugfix on 0.2.5.1-alpha. > - Don't try to use the pthread_condattr_setclock() function unless > it actually exists. Fixes compilation on NetBSD-6.x. Fixes bug > 17819; bugfix on 0.2.6.3-alpha. > - Fix backtrace compilation on FreeBSD. Fixes bug 17827; bugfix > on tor-0.2.5.2-alpha. > - Fix compilation of sandbox.c with musl-libc. Fixes bug 17347; > bugfix on 0.2.5.1-alpha. Patch from 'jamestk'. > - Fix search for libevent libraries on OpenBSD (and other systems > that install libevent 1 and libevent 2 in parallel). Fixes bug > 16651; bugfix on 0.1.0.7-rc. Patch from "rubiate". > - Isolate environment variables meant for tests from the rest of the > build system. Fixes bug 17818; bugfix on tor-0.2.7.3-rc. > - Replace usage of 'INLINE' with 'inline'. Fixes bug 17804; bugfix > on tor-0.0.2pre8. > - Remove config.log only from make distclean, not from make clean. > Fixes bug 17924; bugfix on 0.2.4.1-alpha. > > o Minor bugfixes (crypto): > - Check the return value of HMAC() and assert on failure. Fixes bug > 17658; bugfix on 0.2.3.6-alpha. Patch by "teor". > > o Minor bugfixes (fallback directories): > - Mark fallbacks as "too busy" when they return a 503 response, > rather than just marking authorities. Fixes bug 17572; bugfix on > 0.2.4.7-alpha. Patch by "teor". > > o Minor bugfixes (IPv6): > - Update the limits in max_dl_per_request for IPv6 address length. > Fixes bug 17573; bugfix on 0.2.1.5-alpha. > > o Minor bugfixes (linux seccomp2 sandbox): > - Fix a crash when using offline master ed25519 keys with the Linux > seccomp2 sandbox enabled. Fixes bug 17675; bugfix on 0.2.7.3-alpha. > > o Minor bugfixes (logging): > - In log messages that include a function name, use __FUNCTION__ > instead of __PRETTY_FUNCTION__. In GCC, these are synonymous, but > with clang __PRETTY_FUNCTION__ has extra information we don't > need. Fixes bug 16563; bugfix on 0.0.2pre8. Fix by Tom van > der Woerdt. > - Remove needless quotes from a log message about unparseable > addresses. Fixes bug 17843; bugfix on 0.2.3.3-alpha. > > o Minor bugfixes (portability): > - Remove an #endif from configure.ac so that we correctly detect the > presence of in6_addr.s6_addr32. Fixes bug 17923; bugfix > on 0.2.0.13-alpha. > > o Minor bugfixes (relays): > - Check that both the ORPort and DirPort (if present) are reachable > before publishing a relay descriptor. Otherwise, relays publish a > descriptor with DirPort 0 when the DirPort reachability test takes > longer than the ORPort reachability test. Fixes bug 18050; bugfix > on 0.1.0.1-rc. Reported by "starlight", patch by "teor". > > o Minor bugfixes (relays, hidden services): > - Refuse connection requests to private OR addresses unless > ExtendAllowPrivateAddresses is set. Previously, tor would connect, > then refuse to send any cells to a private address. Fixes bugs > 17674 and 8976; bugfix on 0.2.3.21-rc. Patch by "teor". > > o Minor bugfixes (safe logging): > - When logging a malformed hostname received through socks4, scrub > it if SafeLogging says we should. Fixes bug 17419; bugfix > on 0.1.1.16-rc. > > o Minor bugfixes (statistics code): > - Consistently check for overflow in round_*_to_next_multiple_of > functions, and add unit tests with additional and maximal values. > Fixes part of bug 13192; bugfix on 0.2.2.1-alpha. > - Handle edge cases in the laplace functions: avoid division by > zero, avoid taking the log of zero, and silence clang type > conversion warnings using round and trunc. Add unit tests for edge > cases with maximal values. Fixes part of bug 13192; bugfix > on 0.2.6.2-alpha. > > o Minor bugfixes (testing): > - The test for log_heartbeat was incorrectly failing in timezones > with non-integer offsets. Instead of comparing the end of the time > string against a constant, compare it to the output of > format_local_iso_time when given the correct input. Fixes bug > 18039; bugfix on 0.2.5.4-alpha. > - Make unit tests pass on IPv6-only systems, and systems without > localhost addresses (like some FreeBSD jails). Fixes bug 17632; > bugfix on 0.2.7.3-rc. Patch by "teor". > - Fix a memory leak in the ntor test. Fixes bug 17778; bugfix > on 0.2.4.8-alpha. > - Check the full results of SHA256 and SHA512 digests in the unit > tests. Bugfix on 0.2.2.4-alpha. Patch by "teor". > > o Code simplification and refactoring: > - Move logging of redundant policy entries in > policies_parse_exit_policy_internal into its own function. Closes > ticket 17608; patch from "juce". > - Extract the more complicated parts of circuit_mark_for_close() > into a new function that we run periodically before circuits are > freed. This change removes more than half of the functions > currently in the "blob". Closes ticket 17218. > - Clean up a little duplicated code in > crypto_expand_key_material_TAP(). Closes ticket 17587; patch > from "pfrankw". > - Decouple the list of streams waiting to be attached to circuits > from the overall connection list. This change makes it possible to > attach streams quickly while simplifying Tor's callgraph and > avoiding O(N) scans of the entire connection list. Closes > ticket 17590. > - When a direct directory request fails immediately on launch, > instead of relaunching that request from inside the code that > launches it, instead mark the connection for teardown. This change > simplifies Tor's callback and prevents the directory-request > launching code from invoking itself recursively. Closes > ticket 17589 > - Remove code for configuring OpenSSL dynamic locks; OpenSSL doesn't > use them. Closes ticket 17926. > > o Documentation: > - Add a description of the correct use of the '--keygen' command- > line option. Closes ticket 17583; based on text by 's7r'. > - Document the minimum HeartbeatPeriod value. Closes ticket 15638. > - Explain actual minima for BandwidthRate. Closes ticket 16382. > - Fix a minor formatting typo in the manpage. Closes ticket 17791. > - Mention torspec URL in the manpage and point the reader to it > whenever we mention a document that belongs in torspce. Fixes > issue 17392. > > o Removed features: > - Remove client-side support for connecting to Tor relays running > versions of Tor before 0.2.3.6-alpha. These relays didn't support > the v3 TLS handshake protocol, and are no longer allowed on the > Tor network. Implements the client side of ticket 11150. Based on > patches by Tom van der Woerdt. > > o Testing: > - Add unit tests to check for common RNG failure modes, such as > returning all zeroes, identical values, or incrementing values > (OpenSSL's rand_predictable feature). Patch by "teor". > - Log more information when the backtrace tests fail. Closes ticket > 17892. Patch from "cypherpunks." > - Always test both ed25519 backends, so that we can be sure that our > batch-open replacement code works. Part of ticket 16794. > - Cover dns_resolve_impl() in dns.c with unit tests. Implements a > portion of ticket 16831. > - More unit tests for compat_libevent.c, procmon.c, tortls.c, > util_format.c, directory.c, and options_validate.c. Closes tickets > 17075, 17082, 17084, 17003, and 17076 respectively. Patches from > Ola Bini. > - Unit tests for directory_handle_command_get. Closes ticket 17004. > Patch from Reinaldo de Souza Jr. >

1 0