- cypherpunks - lists.cpunks.org

Re: [tor-relays] [tor-talk] Platform diversity in Tor network [was: OpenBSD doc/TUNING]
by grarpamp 07 Nov '14

07 Nov '14

On Thu, Nov 6, 2014 at 2:43 AM, David Serrano <tor(a)dserrano5.es> wrote: > On 2014-11-05 23:58:43 (-0500), grarpamp wrote: >> >> The real problem below is the 96% allocation of opensource to >> Linux and 4% to Other opensource. > >> Someone should really do an analysis of platform vs. exit bandwidth >> as well. Anyone? > > Here ya go. Observed bandwidth per OS in relays having the exit flag: > > 93.62% 4459816582 Linux > 4.51% 214639363 FreeBSD > 1.25% 59672066 Windows > 0.25% 11754598 Darwin > 0.17% 7896687 Bitrig > 0.15% 6964863 OpenBSD > 0.06% 3091495 SunOS This excessive Linux dominance in both node count and bandwidth really should be balanced out, like why not? I'd expect if some of the big relays switch to any other OS that would flatten out the bandwidth part pretty easily. You'd have to check say the top 10, 25, 50 or so relays to see to what extent they are part of this mess, I'm sure it's similar.

1 0

Reverse Engineered Google Docs
by Александр 06 Nov '14

06 Nov '14

http://features.jsomers.net/how-i-reverse-engineered-google-docs/

1 0

open ASIC SoC
by coderman 06 Nov '14

06 Nov '14

given interest in open source privacy enhancing technologies, what about open ASIC SoC for privacy routers and other hw? - 32bit RISC opencores. http://cdn.opencores.org/pdf/or1k-asic.pdf - TRNG series as native instruction; avalanche + RF + slow sampled from fast pair into aligned memory target as raw samples, each source tunable via MSR. http://www.cryptography.com/public/pdf/VIA_rng.pdf , http://moonbaseotago.com/onerng/ - Fab with chain of custody via domestic 22-nm foundry services. (Intel, other?) - Random quality and critical component validation with a FEI Versa 3D tear down , http://siliconexposed.blogspot.de/2014/03/getting-my-feet-wet-with-invasive… what else required? (IOMMU isolation?)

3 6

cypherpunk consortium for carefree crossings
by coderman 06 Nov '14

06 Nov '14

regarding border crossing behaviors of the powers that be, it seems the most expedient response to detainments and data dupe'ings [0][1][2] is to answer with deterrent. possibilities to dissuade dastardly detours: - sunlight the best disinfectant; publicize attempts at intimidation and friction at crossings. - every detainment incurs a disclosure of intelligence collection technique. (requires a pool of un-disclosed spook ballast) - every detour spurs privacy enhancing technology development. a bounty for the most desired improvements, aggressive tactics lead directly to more users, better features, stronger privacy. other ideas? how many Tor trac tickets threatened to be develop to ensure ioerror a safe domestic passage? best regards, 0. "... her work has been hampered by constant harassment by border agents during more than three dozen border crossings into and out of the United States. She has been detained for hours and interrogated and agents have seized her computer, cell phone and reporters notes and not returned them for weeks." - https://en.wikipedia.org/wiki/Laura_Poitras#Government_surveillance 1. "I'm flying back to the US after writing about helping Ed Snowden and the journalists he leaked documents to. Wish me luck at the border." - https://twitter.com/micahflee/status/529191556897443840 2. "I'm looking forward to the time when we don't have to worry about politically motivated US border harassment. A distant time, probably." - https://twitter.com/ioerror/status/529206920838930433

2 1

Re: [tor-relays] [tor-talk] Platform diversity in Tor network [was: OpenBSD doc/TUNING]
by grarpamp 06 Nov '14

06 Nov '14

>> I'd agree simply because Windows presents a much larger attack surface. The >> amount of code running on a minimal Unix installation plus Tor is a lot less >> than a Windows system, especially network facing code. > ... > Running code, or network accessible code? Either way I don't see how > you came to that calculation. 'Minimal' Unix + Tor + SSH restricted > by SSH Key vs 'Minimal' Windows + Tor + RDP restricted by Client > Certificate. I also don't know what you mean by 'minimal' as very few > ... > I think a Windows Server, properly configured, is roughly as secure as > a properly configured Linux Server. > ... > I think there have been more bugs that result in RCE on production > Linux servers running SSH and a webserver in the past 4 years than > there have been in production Windows servers running RDP and IIS. > ... > I think if you're pointing fingers at China and the NSA, you should > assume they have RCE in both Windows and Linux. > ... > I think running relays on Windows Servers is no worse than running > relays on Linux Servers, and therefore it is good to do, because it > adds diversity to the network. Attack surface on a well adminned relay comes down to three things: - Network stack itself (kernel) - Daemon software itself (tor + remote admin) - Their respective use of other kernel/library/shell provided resources. I might suggest the current proportion of Windows to Linux is roughly ideal. This is primarily because, all other things set equal at 'minimal' (= tor + remote admin), good adminning, and good control of corporate secrets (or moles)... Windows still has one huge strategic weakness at that point... the magic packet. It's the whole binary vs. opensource argument. So essentially, the correct ratio of the two might be the odds you place that a binary OS has a magic packet. Today's node count shows 73% to opensource platforms. I'd suspect 73% is about where a lot of analysts might bet on Windows being magical, whether by/for the NSA, or any other reason or source. (Remember this... https://en.wikipedia.org/wiki/NSAKEY That was just from running 'strings'. Good luck trolling all of Windows with a disassembler... a nice fat payoff if you do. And the number of disassembling vs. opensource auditors is probably even more heavily skewed. And Windows is 'trusted' by buyers, nor can you replicate their binaries from any 'source code sharing agreements'. Then it's Patch Tuesday again... so it could be no one has or ever will disassemble audit it. So odds end up being pitched instead. And for many applications, that's good enough.) The real problem below is the 96% allocation of opensource to Linux and 4% to Other opensource. That's something that should be fixed. For these purposes, it doesn't matter which BSD/Other you pick... once you get the security odds there back towards say 50:50 Linux:Other, then you can debate userland and relative security amongst them all you want. Here's some links to get you started, including two other main branches of the Unix Kernel family tree at the bottom... 5939 Linux 1591 Windows 173 FreeBSD http://www.freebsd.org/ 56 Darwin 44 OpenBSD http://www.openbsd.org/ 7 NetBSD http://netbsd.org/ 6 SunOS 4 Bitrig https://www.bitrig.org/ 2 GNU/kFreeBSD https://www.debian.org/ports/kfreebsd-gnu/ 2 DragonFly http://www.dragonflybsd.org/ 0 Illumos (OpenSolaris) http://wiki.illumos.org/display/illumos/Distributions 0 Minix http://www.minix3.org/ Official metrics... https://metrics.torproject.org/network.html Someone should really do an analysis of platform vs. exit bandwidth as well. Anyone? Also, isn't there some project out there that is counting the historical number of kernel bugs+severity per OS over time? [To cpunks to cover all the other volunteer node based networks out there that could benefit from tuning their platform ratios.]

1 0

Cody Wilson to run for Bitcoin Foundation board, plans its destruction
by grarpamp 05 Nov '14

05 Nov '14

http://upstart.bizjournals.com/entrepreneurs/hot-shots/2014/11/04/cody-wils…

3 2

Crypto collision used to hijack Windows Update goes mainstream
by Georgi Guninski 05 Nov '14

05 Nov '14

http://www.theregister.co.uk/2014/11/05/md5_hash_collision/ The cryptographic hash collision attack used by cyberspies to subvert Microsoft's Windows Update has gone mainstream, revealing that MD5 is hopelessly broken.

1 0

BitLocker, OneDrive, PRISM
by rysiek 05 Nov '14

05 Nov '14

Hi there, WTF am I reading? http://cryptome.org/2014/11/ms-onedrive-nsa-prism.htm "... because the [BitLocker] recovery key is automatically stored in SkyDrive for you." -- Pozdr rysiek

3 2

What NSA Is Doing to Improve Security Post-Snowden
by George W. Maschke 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 NSA Director Mike Rogers spoke at Stanford University's Hoover Institute this past weekend, and a faculty member asked him what the NSA is doing with regards to personnel security to stop another incident like Edward Snowden's release of classified documents. Interestingly, the first and primary measure that the NSA director mentioned was polygraph testing. It's interesting because polygraphy is a thoroughly discredited pseuodoscience. It depends on the person being "tested" being ignorant of the trickery on which the procedure relies. How ironic that America's most technologically sophisticated intelligence agency relies on early 20th century pseudoscience as the keystone of its personnel security program. For additional commentary, see "NSA Director Mike Rogers on Polygraph Screening" on the AntiPolygraph.org blog: https://antipolygraph.org/blog/2014/11/04/nsa-director-mike-rogers-on-polyg… George Maschke PGP Public Key: 316A947C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUWf25AAoJEEYqwKuPDNWqPMgP/3QDCJH5epob6MKlYYTAH30A gYQBfIkIa93Wufhmt+Od2zlbQSxkshEnD/mNnujqih/bybrvj+OSLR2ejCwzoaL1 PMoR07E1kJRjKw0wEIbxnf0SLVGJedOHhUsu6/WUJ9DWYZ7mCiSyVgH+AOIhaQDy SUFoi9Nl3dZvUBN8FqRPeL4tHp0LG6QIV3N0pZZddOw68qIeI53HQ8Rv14VAFgix oAIzHJ77Y+0gcyp1WIxFyopVfnioezf15YVSl3hC0z+m1V/lRFUullHJWWbG4nm9 xenuqWwVF5T6wj4Lstep5seKBoKobr1+haGPkVfggNcfOMAY4PCjolzmA4j8yOci Sn8vx7U1eVGAwdPkppT33ug+GWzj5yXMVCjH95U+JyO6My4cY97YOhtQe5fUn0ep vhbPMRy+Q1lvtRYd9lZI/ZLRVOUp1652IqjhgCmIMCCR3ZtSPWq3RQmreepf6XgA tCU2u6SkpgK7N2+NvMMFe+lrcBUIxO6MTBW61xl6CHmw3WIsPTUfstwGwcUkm2Im jjnQuLNqE+IMEsaZ0202r9791DnohXOtbg7epGSayk35oBA4xvCZm0/A4vStgCSO Dt8jSht5ULJZJ1jqnSkkAzfXrKHxlCFRlRkrNWn7qcTKGm2Iza0DCA5513cU80xj AD3rPiQBA0/r6N78GYaY =9xb+ -----END PGP SIGNATURE-----

3 3

Wind River Security Features and Cryptography Libraries
by John Young 05 Nov '14

05 Nov '14

Wind River Security Features and Cryptography Libraries (which appear to be the basis of the $750,000 fine by BIS) http://cryptome.org/2014/11/wind-river-security-crypto.pdf

2 1