- cypherpunks - lists.cpunks.org

Qubes 3.0 out
by Eugen Leitl 02 Oct '15

02 Oct '15

http://blog.invisiblethings.org/2015/10/01/qubes-30.html Qubes 3.0 Oct 1, 2015 • Joanna Rutkowska About 5 months after the initial release of Qubes 3.0-rc1, we're now releasing the final 3.0 today! Let me quickly recap the main "killer features" of Qubes OS 3.0 compared to the Release 2: Qubes is now based on what we call Hypervisor Abstraction Layer (HAL), which decouples Qubes logic from the underlying hypervisor. This will allow us to easily switch the underlying hypervisors in the near future, perhaps even during the installation time, depending on the user needs (think tradeoffs between hardware compatibility and performance vs. security properties desired, such as e.g. reduction of covert channels between VMs, which might be of importance to some users). More philosophically-wise, this is a nice manifestation of how Qubes OS is really "not yet another virtualization system", but rather: a user of a virtualization system (such as Xen). We upgraded from Xen 4.1 to Xen 4.4 (now that was really easy thanks to HAL), which allowed for: 1) better hardware compatibility (e.g. UEFI coming soon in 3.1), 2) better performance (e.g. via Xen's libvchan that replaced our vchan). Also, new Qubes qrexec framework that has optimized performance for inter-VM services. We introduced officially supported Debian templates. And finally: we integrated Whonix templates, which optimize Tor workflows for Qubes. As explained in our Release Cycle Documentation (something we finally created and been polishing through this 3.0 branch development), there is almost no new features in 3.0 compared to 3.0-rc1, essentially only bugfixes, intermixed with a few minor improvements. But, while the 3.0 branch was "maturing", and getting bugfixes merged, most of our work has been focused on the 3.1 branch, which is adding a bunch of exciting new features, as indicated on our high-level roadmap, specifically: UEFI support (see this ticket for more info and test images). Live USB edition (preview for which we already released earlier this summer, now it will get merged into the master branch for 3.1) Management/pre-configuration stack: The Big Killer Feature of the upcoming 3.1 release, which will make it easy to provide out of the box configurations for things such as: out of the box Whonix/Tor, or Split GPG, or default USB sandboxing VM, which currently the user must do manually. We're planning to release the first candidate for 3.1 as early as the end of October, actually. But development of any serious project is not just adding new features, although that's admittedly the most exciting thing for any developer to do. In R3 we have finally started implementing this golden thought, and the first tangible outcome of this change of attitude is the automated testing framework which we have been using for all the releases in this 3.0 branch already. We hope this results in much more polished, stable code. Other things we've started to be increasingly prioritizing recently, and only plan to intensify in the coming year are: 1) making Qubes more accessible to people (think easier to get hardware that can run Qubes OS), and 2) easier to use (better UX and UI). I think this is also pretty exciting, actually. As previously announced earlier this summer, we have decided to dedicate this release of Qubes OS to the memory of Caspar Bowden: Caspar's dedication screenshot Caspar has been a proud user, supporter, and advocate for Qubes OS, and also a friend. I think he would have liked that dedication. The Qubes 3.0 ISO can be downloaded from here. We have also released another scheduled Qubes Canary today. I would like to thank all the people who have contributed to this huge effort of creating a new "reasonably secure" desktop OS. I believe we're making together an important and meaningful thing here. Let's keep this going!

1 0

Allegedly Volkswagen cheated to both governments and lusers
by Georgi Guninski 02 Oct '15

02 Oct '15

http://www.theregister.co.uk/2015/09/25/vw_pollution_just_the_tip_of_the_ic… <quote> Volkswagen is being rightly condemned from all directions, as its methods were particularly cynical: its engine software would sense when the car was in a test environment and cut back NO_x output temporarily. As soon as the car was no longer under test, the car would change mode and emit huge amounts of NO_x. This wasn't done for no reason – if a machine is allowed to generate NO_x freely, it can be very fuel-efficient – and thus, of course, its carbon emissions can be very low too. </quote> Comment: Probably best defense for VW lawyers is: "We got hacked and the hack made this. We take sickyouareity seriously"

5 13

Re: [tor-talk] KARMA POLICE
by Ryan Carboni 02 Oct '15

02 Oct '15

http://routersecurity.org/ It just simply doesn't matter. To have a modern lifestyle, depends upon having devices of dubious or poor security. The government has shown a willingness to accumulate dossiers (seemingly including IRC chats), and then leak them when it serves their own needs. Our Congress is criminally incompetent. The chairman of the House Oversight committee just had his secret service application leaked, and there is no threat of the the most powerful tools that Congress has: appropriations micromanagement (famously done in Congressional reconstruction) or impeachment. The same goes for Benghazi (which probably was a meeting with a rebel group that went sour). I think our government is more malicious and less competent than Hoover's FBI. For comparison: “Another early Bureau practice was to index names on lists when the list reflected possible association with a subversive group (e.g. Communist Party petitions or subscriptions to the Daily People's World), or where the names might have future reference value (American Legion contacts, loyalty forms). The heavy demands on staff time and resources, however, and the absence of substantial information about the individuals whose names appeared in the this context caused the Bureau to limit indexing in these areas. In 1949 the Executive Conference decided that names on Communist Party petitions and subscription lists to the Daily Worker and Daily People's World be indexed in the appropriate field office only.”

1 0

tox
by Juan 02 Oct '15

02 Oct '15

I've been playing with tox(thanks rysiek!) and it looks rather interesting. I noticed however that it's not listed here https://www.eff.org/secure-messaging-scorecard Maybe somebody who knows somebody at eff could drop them a message? Also, apart from retroshare (and tox), is there any other p2p messaging network?

9 22

Re: [tor-talk] KARMA POLICE
by Zenaan Harkness 01 Oct '15

01 Oct '15

On 10/1/15, Ryan Carboni <ryacko(a)gmail.com> wrote: > http://arstechnica.com/tech-policy/2013/06/exclusive-in-2009-ed-snowden-sai… > > https://theintercept.com/2015/09/25/gchq-radio-porn-spies-track-web-users-o… > > Yep. > > Time to create a massive donation drive for Tor. I applaud and share your enthusiasm and intention. But. The assumption that "enough money will solve the problem" is generally false. What is needed is a supra-tor or supra-"supplied by the govt/ isp" physical network layer - or at least enough nodes in a 'slightly new design' network which can use those nodes (assuming there are enough of them, which might be large number, I have no idea). That means individuals setting up their own links between them and their neighbors. Neighbors is a loose concept - wireless links can hop a fair distance. The principle is: - if you don't control it, if you did not physically set it up, it monitors you; - if you don't install and 'control' the software running on the hardware, it monitors you; - if your hardware is backdoored before you receive it (e.g. built in hidden other-than-wifi radio, keylogging cpu microcode, full hidden net sniffing computer in your ethernet port), notwithstanding the software you install on it, it monitors you. There is so much room for necessary improvement that the situation is depressingly grim. TBB/Tor is at least something - just be sure you understand what it is, and what it is not. Good luck and surf safe, Zenaan

1 0

CloudFlare Keyless SSL WAS Re: Snowden on the Twitters
by Travis Biehn 01 Oct '15

01 Oct '15

An oldie, somewhat OT. I enjoyed CF's bit of engineering here - of course CF is still a point where they are working with injectable plaintext. At least they don't have your private key material. https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ What would be solid is if there were a browser module that did several things: Eliminated JavaScript dynamic calls (eval, new function(), setTimeout, setInterval, so on.) Eliminate 3rd party assets. Allowed web assets to be signed. Allowed sets of web assets to be versioned (and attested to by 3rd parties.) Dynamic HTML and JS (read, non-static HTML & JS) would not be supported. The combination of signing, versioning and lack of dynamic features paves the way for uninjectable, client-side in browser encryption/decryption. Something AFAIK we cannot do today. Is anyone working on it? -Travis On Wed, Sep 30, 2015 at 11:23 AM, Georgi Guninski <guninski(a)guninski.com> wrote: > On Wed, Sep 30, 2015 at 01:26:18AM -0400, grarpamp wrote: > > https://twitter.com/Snowden > > How this scores on twatter: > > 1.03 meeelion followers for about 23 hours on twatter? > (not sure about the error terms). > > -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

3 6

US Pres Candidate Carly Fiorina Supplies NSA, Spying, Torture, Warmongering and Bankruptcy
by grarpamp 30 Sep '15

30 Sep '15

http://motherboard.vice.com/read/carly-fiorina-i-supplied-hp-servers-for-ns… https://www.yahoo.com/politics/carly-fiorina-defends-bush-era-torture-and-s… http://politics.slashdot.org/story/15/09/29/220239/carly-fiorina-i-supplied… According to an article at Motherboard, shortly after 9/11, NSA director Michael Hayden requested extra computing power and Carly Fiorina, then CEO of HP, responded by re-routing truckloads of servers to the agency. Fiorina acknowledged providing the servers to the NSA during an interview with Michael Isikoff in which she defended warrantless surveillance (as well as waterboarding) and framed her collaboration with the NSA in patriotic terms. Fiorina's compliance with Hayden's request for HP servers is but one episode in a long-running and close relationship between the GOP presidential hopeful and U.S. intelligence agencies. $500 billion over ten years by one estimate—and an upgrade of “every leg of the nuclear triad,”

2 1

Windows TrueCrypt Fatally Flawed
by Brenda Fernández 30 Sep '15

30 Sep '15

Windows TrueCrypt Fatally Flawed Posted on September 30, 2015 <http://qntra.net/2015/09/windows-truecrypt-fatally-flawed/> by Bingo Boingo <http://qntra.net/author/bingoboingo/> Continued research after the first TrueCrypt audit yielded inconclusive results has discovered fatal privilege escalation vulnerabilities allowing for complete takeover <http://www.itworld.com/article/2987438/newly-found-truecrypt-flaw-allows-fu…> (archived <https://archive.is/tJSlv>). So far this is known to affect TrueCrypt on Windows boxes <http://qntra.net/2015/08/windows-10-banned-from-numerous-torrent-trackers/>, but there is still potential for other flaws to be discovered in TrueCrypt on other platforms. Details of the vulnerabilities are not yet disclosed, but this supports the possibility that it may not be possible at all to develop software offering any level of security on the Windows platform. This entry was posted in News <http://qntra.net/category/news/>, Software <http://qntra.net/category/software/>. Bookmark the permalink <http://qntra.net/2015/09/windows-truecrypt-fatally-flawed/>. One thought on “Windows TrueCrypt Fatally Flawed” 1. Bingo Boingo says: September 30, 2015 at 12:44 am <http://qntra.net/2015/09/windows-truecrypt-fatally-flawed/#comment-62417> Further: The VeraCrypt derivative forked from TrueCrypt though this particular issue was reportedly patched, likely continues to posses undiscovered security issues. -- Brenda Fernández me(a)brendafernandez.com GPG: CE5BEE6C81FCA4D4 <http://pgp.mit.edu/pks/lookup?op=get&search=0xCE5BEE6C81FCA4D4>

3 2

And here it is - In UN Speech Putin Blasts US Foreign Policy
by Zenaan Harkness 29 Sep '15

29 Sep '15

In UN Speech Putin Blasts US Foreign Policy http://russia-insider.com/en/politics/un-speech-putin-blasts-us-foreign-pol… (includes full official transcript) And, as the image tells, Obama not happy: http://russia-insider.com/en/politics/multinational-deal-may-allow-assad-st… "Multinational Deal May Allow Assad to Stay" (Many quotes I am tempted to quote, but better is enjoy the fullness of this blessing in action. The world be grateful. Z)

2 1

What CBS Edited out of Putin's Interview [on "60 Minutes"]
by Zenaan Harkness 29 Sep '15

29 Sep '15

So, what was edited from Putin's rare "60 Minutes" interview on CBS? Those bits embarrassing to USA government it seems - who would have thought ... Enjoy, Zenaan "What CBS Edited out of Putin's Interview" http://russia-insider.com/en/media-criticism/what-cbs-edited-out-putins-int… A full transcript and a youtube link is here: "UPDATED: "We know everything" - Putin's interview on American CBS PLUS what was cut from the interview" http://fortruss.blogspot.si/2015/09/putins-interview-on-american-60-minutes…

1 0