- cypherpunks - lists.cpunks.org

Palantir pricelist
by Eugen Leitl 17 Sep '14

17 Sep '14

https://news.ycombinator.com/item?id=8325441 Palantir Pricelist (page 27) [pdf] (gsaadvantage.gov) 173 points by thebyrd 15 hours ago | flag | 58 comments bane 10 hours ago | link For folks who've never seen one of these. 132-33 - Price for a Palantir server, priced per core. $141k per core. Includes 1 year of "maintenance" (support and software upgrades). 132-34 - This is the maintenance for second year on. $28k per core. How many users can a core support? I dunno. But let's say you can serve 50 people off of a 4-core system (you can redo the math for the number of users). You initial purchase is $564k. Or about $11k per user. Each year after that, if you want software updates, it'll cost you $113k or or about $2.2k per year per user. So let's say you use the system for 3 years. That's over $15k of software per user over that time. Plus there's training ~$2k per user. Or another $100k in training costs. And then who knows how many hours of engineering and "ninja" services. But a CONUS (within the U.S.) FSR is billed at about $300k per year for a full-time person on staff. Let's say you need two of them to support those 50 users. Added up for 3 years of Palantir: $1.5million I'll let you decide if that's good value, but that works out to around $30k per user partial TCO (not including power, security, networking, local IT staff support, etc.). reply elblanco 5 hours ago | link I've done a bit of work with Palantir. This is basically spot on. They're really cagey about the core/user requirement in real life so I'd be comfortable in saying most customer over purchase cores. They usually staff 2-3 full time guys for every 30-50 people and the implementation takes forever. I know of more than one place that didn't have a working system a full year after purchase. Meaning the maintenance had already expired on that first year. Your later comment about the crack model is also spot on. There's a fairly long list of disgruntled places that bought on discount and are now being hit with huge O&M maintenance fees and are looking for a way out. I think they're government customers are slowly going away. They're starting to show up more overseas here. Palantir recently opened up a Seoul office. But how much of whatever business they get out of it is government and how much of it is commercial is anybody's guess. reply Cthulhu_ 58 minutes ago | link Sounds... Actually doesn't sound as bad as SAP, Europe's largest software package/manufacturer for... IDK, business software. IIRC, every implementation requires you to hire half a dozen SAP engineers for a decent hourly rate just to set up the system, then keep them on to train and maintain the system. reply nostrademons 8 hours ago | link Not that out of line for what much other enterprise software costs. A Bloomberg terminal runs about $24k/user/year: http://qz.com/84961/this-is-how-much-a-bloomberg-terminal-co... When I was doing enterprise financial software it wasn't uncommon for contracts to run in the millions per year. reply bane 7 hours ago | link Yeah it kind of depends how you look at it. Is it specialty software that provides some critical function they can't get elsewhere? Or is it Microsoft Office, everybody gets it and it should really be like $150/seat. I should have also added to my original post, this is their GSA schedule. For these specific line-items, the government considers this the "prenegotiated lowest price". This simplifies purchasing. So if somebody in the government wants buy another core (item 132-33) they just ring up Palantir or their GSA schedule VAR (reseller) and ask for a 132-33 volume:1 and they know that it'll cost $141k and be good for 1 year of O&M. The downside of being on the GSA schedule is that it means that there are limits on your ability to change prices year to year to reflect a change in business environment. Say next year you want to drop the price by 50%. That's not allowed, since it would basically mean that you weren't selling your software at the lowest possible prenegotiated price. Similarly if you want to increase it, you're limited in that as well. I think the +- variance can't exceed 10% in a single 12 month period, but I might be wrong. The other downside is that this basically provides your prices in public so your competitors can see what you charge, which can be critical information in contract bids. There's always a loophole. For example, convince your customer to not buy off of the GSA and sell them a "package" at some discount off of GSA. That "package" counts as a different SKU and the GSA doesn't apply. So for example, you could make a Palantir "starter kit" composed of 2 core license (normally $282k) 1 extra year of O&M maintenance for both cores (normally $56k) 500 hours of Ninja Services @ $150/hr (normally $98k) 500 hours of CONUS FSR Service @ $120/hr (normally $73k) all for the grand total of $350k or some such, instead of the normal price of $510k. A $160k discount. Any government purchaser would fall over themselves to try to make this happen since it's a >30% discount off of the normal GSA schedule prices (which they can refer to and are governed by various rules). This looks fantastic on their yearly performance eval "-saved government $160k on purchase of Palantir package deal" This is the crack model. When the O&M runs out in two years and they come asking for more, well, there's no deal anymore, and the GSA schedule prices on O&M and people have gone up 20% in that time. edit keep in mind that this company has raised almost a billion dollars and is valued at something like $9 billion dollars. reply elblanco 5 hours ago | link > raised almost a billion dollars and is valued at something like $9 billion dollars. And now particular plans to sell or go public. This keeps all their financials private and the fact that they have to keep doing new fundraising rounds every few months does not make me think they're making money. At $9bil valuation, finding a buyer is going to be really tough. They're a really weird company to deal with too. A bit cultish, the CEO is kind of flake the few times I've met him at their conferences. I get the impression that he's not really running the show, he's impossibly unqualified with zero history in any of the spaces they sell into and no business background of any useful type. Their offices are nice, loads of free great food, but when people emerge from their offices for lunch it looks like they're on a death march. If you ask any of them if they like it there you'll always get a blank stare and a "I love it at Palantir, Palantir is great" answer. Combined with the track jackets and sketchy legal history (well worth a read), it's kind of off-putting. reply msh 4 hours ago | link Can you provide a link on the last line? reply elblanco 1 hour ago | link eldemar is providing some of the information. I'd add some color the i2 suit. The fraud perpetrated by Palantir was actually so organized and so bad (they set up an entirely fake front company in another state), that the suing company asked the judge for the case to be tried under RICO rules...which are basically rules put in place to fight the mafia. The judge agreed that it qualified under the law (immediately tripling any damages that would have been awarded) and Palantir settled with i2 immediately after that and the case was dropped. Word on the street is the settlement was for an almost 9 figure sum and Palantir immediately went into another fundraising round to cover the loss and sustain operations. The employees (all senior execs) at the center of the fraud kept their jobs but didn't show their faces in public for a couple years (they had been acting as a de facto spokespeople during trade events). They're back in the public eye now. Yes, that's correct, Palantir is currently run by people who's activities were qualified by a judge as falling under legal guidelines setup to fight the Mob. You can say what you want about the big defense contractors, incompetence and lobbying and all that (which Palantir does in spades and has even gotten in trouble for not disclosing some lobbying deals) but mafioso they ain't. Some more here: http://venturebeat.com/2011/02/16/palantirs-third-black-eye-... http://www.law360.com/articles/225544/palantir-i2-settle-tra... This isn't even touching the HBGary union busting scheme and the Bank of America anti-Wikileaks proposal. And other very anti-democratic activities. I don't know what happened to the employee with the anti-Wikileaks deal, but the one with HBGary was the stuff of dystopian nightmares. The employee responsible was publicly terminated but actually it turns out was just sent away for a bit and then quietly either rehired or just turned back up to a job he never lost. Nobody would have ever known about this if Anonymous hadn't had a very public fight with the CEO of HBGary Federal and hacked their network to pull down some documents, revealing an ongoing 3-way partnership with Palantir). http://www.dailykos.com/story/2013/06/23/1218189/-HBGary-Pal... They appear to be offering a revolving door to high level government supporters who then later become "consultants" for the company. http://www.mausstrategicconsulting.com/topical-analysis-blog... "such as former head of the National Counterterrorism Center Michael E Leiter who had said to himself “There’s Karp with his hair and his outfit—he doesn’t look like me or the other people that work for me,” before becoming a supporter and then consultant for Palantir" and heavy lobbying (which explains some of the bizarre support they get in congress while the generals go blue in the face arguing against them) "It has also been active in formal political lobbying, recruiting former senators John Braux and Trent Lott, (5) with its lobbying expenditures increasing steadily from 2010 to 2013 when its total annual investment exceeded $1.1 million" more examples http://www.republicreport.org/2014/palantir-zach-wamp/ I've heard rumors that even the CIA is trying to distance themselves from them and find alternatives. reply eldamar 3 hours ago | link They essentially defrauded their chief competitor, i2, so that they could copy their features and reverse engineer their software so Palantir's system could integrate with it. Read the full complaint here for the juicy details: http://www.scribd.com/doc/36371667/i2-v-palantir-080910 Note that all the Palantir employees involved in this suit are still high-ranking Palantir executives. There is also the case of the Wikileaks/HBGary fiaso; the main individual involved in that mess is still a high ranking Palantir employee as well. reply Spooky23 4 hours ago | link I was involved in a Oracle Financials implemention a few years ago. Forget about the Oracle part... the IBM/Tivoli garbage used to monitor the IT systems cost about $1M in licensing alone! reply hkmurakami 5 hours ago | link They sure have chosen their preferred client industries of Government and Financial Services wisely then. Those industries (a) are accustomed to paying that much for their technology, and (b) are very unlikely to leave your platform once you start using your wares, since the difficulty of getting them as a customer in the first place (and how slow they move and how much paperwork / due diligence is required) directly translates to difficulty for them to move off of your system. Brilliant. reply elblanco 5 hours ago | link there's a fair amount of vendor lock-in in this space as well and Palantir is pretty good at it. They talk quite a bit about open standards and what not. But moving off of their platform and onto one of the competing ones is basically impossible. They've done a fantastic job at disrupting the link-chart market (which is surprisingly robust) and making it seem like customers are buying something else, but at 2-3x the price of the competition. They hide their sales guys as "forward deployed engineers" and obfuscate their sales process to the point where it doesn't seem like you've ever dealt with the kind of sketchy enterprise sales goon you'd deal with from any of their competitors. They're very smart. reply poolpool 8 hours ago | link Navigating enterprise sales cycles is a giant pain but man is it profitable compared to the latest social startup du jour. reply fishcakes 4 hours ago | link The alternative to Palantir - an alternative enterprise bespoke system or one built by the companies' or Gov's IT department - costs a whole lot more (25x) and often doesn't work! Palantir is a great value. reply elblanco 4 hours ago | link I presume you're talking about the DCGS-A system. Palantir has done an expert level job confusing the public on this. That system definitely has problems (it's terrible and sucks in many places), but it's a system of much larger capability and complexity than Palantir. Comparing Palantir to it is like comparing a wheel to a an entire transport system. Palantir could comfortably fit in as a single capabilty in DCGS-A (and probably do a better job than the stuff currently filling in that role), but it could never replace it. It's basically just a federated search, mediocre map and halfway decent link-analysis tool. But ask it to do anything even remotely outside of those three things and you're basically dead in the water as it doesn't offer anything relevant to all the other millions of things DCGS-A provides. DCGS-A is more than just some analytic tools. The reason it's not part of DCGS-A is very political and complex and as much Palantir's doing as the Army's, but the answer is that the components that are on DCGS-A that basically do what Palantir does were selected because they're cheaper over the long run, even if a bit clunky. For example, on the client side, there's presently a forward looking mandate from big Army to drop flash and java clients (because they're an IT administrative menace). Palantir's front end is Java. reply steakejjs 8 hours ago | link The question I am asking is, do they really have the demand to make $1.5million a customer pay (or look like one day it could pay) for their expenses? My guess is your estimates are really conservative. reply halcyondaze 8 hours ago | link Thanks for breaking that down. I was looking cluelessly at the price sheet for the actual prices. reply incision 9 hours ago | link All right in line with just about any sort of "Enterprise" software. Training and implementation services are downright cheap. Maintenance is the standard 20%. The last big vendor PO I had to look at put every professional services line item at $300-360/hr with $320 being about average. reply sien 9 hours ago | link Also Palantir's software actually does something more challenging than a lot of enterprise software. People should go and see what small packages from Oracle, HP, Tibco & IBM cost. It's incredible. reply elblanco 5 hours ago | link Funny you should mention that. Palantir's main competition in the governmeent, i2, is now IBM. i2 was selling their software at some fraction of Palantir's and in the DoD space it's basically as ubiquitous as Microsoft Office. Palantir is everywhere, but it doesn't end up being used nearly as much. reply meowface 6 hours ago | link Yep, absolutely. This is a perfectly reasonable price for good enterprise software that actually adds value to an organization. (God, I feel like a middle manager just by typing that...). My company spends tens of millions per year on some really awful enterprise software unfortunately. reply aliasaria 6 hours ago | link Favourite part: "Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien." reply jamesash 6 hours ago | link Funny, but necessary. The Zaentz company is notoriously litigious. From Zaentz' Wikipedia article: "In 2011, Zaentz's company began several legal actions against small businesses in the UK to enforce their "Hobbit" trade mark, including the Hungry Hobbit cafe in Sarehole, near Birmingham[13][14] and a pub in Southampton, England, which had traded as The Hobbit for twenty years.[15] This raised the ire of many British correspondents such as Stephen Fry, who described it as "pointless, self-defeating bullying." reply Jabbles 7 hours ago | link Agencies can browse GSA Advantage! by accessing the Internet World Wide Web utilizing a browser (ex.: NetScape) reply mikegreen 8 hours ago | link Do not confuse the GSA schedule with actual implementation cost (or TCO as mentioned below). The prices are a starting point and as with any relationship, they can (and will, if the buyer is smart) be negotiated. Source: sold & implemented alot of software for the gubbmint. reply hendzen 6 hours ago | link If you read between the lines, notice how the "Palantir Gotham Appliance" for 151,042.82 includes "Palantir recommended...database software licenses." I would bet Oracle (or MS/IBM) is getting a hefty chunk of that. reply mmcclellan 4 hours ago | link Yeah but it's only $10k a core more. This job posting lists Oracle and PostgeSQL: http://www.palantir.com/careers/OpenPosDetail?id=a0m80000002... reply dfc 4 hours ago | link I think it is Postgres. reply amalag 10 hours ago | link You can't do diddly with an off the shelf install. They get you on the Implementation Ninjas and Support. reply elblanco 5 hours ago | link Their implementation periods are horrendous. Their marketing speak and sales drones make it sound like a turnkey appliance...like you just drop it in, point it to your database URLS and you're now playing with knowledge management. But in practice there's months of custom backend Java development (the entire tech stack is Java 1.6 or something horrible) to build the connectors and map the data into their backend, then months of ontology management meetings to build up the one-true-model (TM) for all your enterprise needs. Then months and months of post deployment tweaking and continuous work to keep the system alive and fix issues when some of the data sources change schemas or something. I've heard things like average time from purchase to full deployment is something like 9 months. But from my time dealing with them I think it's much longer. reply fishcakes 4 hours ago | link That is simply FUD – Palantir guarantees to customers that their software is working within 90 days AND has generated results. They offer a refund if not. Their homepage said this for a while! reply elblanco 4 hours ago | link Well, feel free to buy a core and let me know how long it takes before you're up and running. Having been on the inside during 3 of their deployments, and on the outside of 2 more, I can definitely say 90 days is wildly optimistic. edit never mind, after reviewing your comment history, it looks like you probably work for Palantir. You should probably disclose that. I stand by my comments about deployment times. reply capkutay 9 hours ago | link I think they get you on the off the shelf price too.. $150k/core...say you run it on a cluster of relatively puny machines ...($150k * 4 cores) on a 4 node cluster is already above $2m. reply dlinder 7 hours ago | link 132-51 CONS CONUS FSR Support hourly rate. CONUS rates will be billed for Services performed outside the continental U.S. unless in a warzone. Normal business hours are defined as an 8-hour work day (rate is 15% more outside of normal business hours). $ 146.60 132-51 OCONS OCONUS FSR Support hourly rate. OCONUS rates will be billed for Services performed in a warzone. Normal business hours are defined as a 12-hour work day (rate is 15% more outside of normal business hours). $ 195.47 reply bane 7 hours ago | link I'm actually surprised how cheap their OCONUS warzone rates are. Many contractors will pay hazardous bonuses, time in theater bonuses and living condition bonuses on top of the CONUS base pay. Added up it can far exceed this kind of rate. But this is probably helpful for people getting into consulting to see what hourly rates are for this kind of work. In my experience these rates are actually fairly cheap. I'm used to seeing $170-200 for most things billed to the government. But I've also heard Palantir has fairly conservative pay caps, that might account for the low rates. reply judgardner 10 hours ago | link 132-51 | IMS | Implementation Ninja Services reply dkarapetyan 9 hours ago | link So ost. reply bane 6 hours ago | link It's less automated data analytics and more chart drawing and semantic knowledge base management tied to a federated search system. Their principle competitor is http://www-03.ibm.com/software/products/en/analysts-notebook They used to have a free trial you could run via java webstart on their website, but they've taken it down. Here's a video https://www.youtube.com/watch?v=f86VKjFSMJE It's big data in the sense that using google's search box is big data. But from my time using their demo a couple years ago, the actual tool is fairly small in focus. I don't even think the chart view can show more than a few hundred things. reply mayneack 2 hours ago | link It's still up: https://analyzethe.us/ reply bane 1 hour ago | link Oh okay cool. That's a different demo. The old one was Operation Tradewinds or something. reply mayneack 1 hour ago | link Tradestop is what you're thinking of. reply AJ007 5 hours ago | link Interesting, it looks a lot like Maltego. reply fishcakes 10 hours ago | link Pretty affordable considering many other things on the GSA don't work once you buy them! reply jonknee 8 hours ago | link Luckily for Palantir whether or not it works is classified. I have my doubts. I'm sure it "works", but I'm also sure it's a giant waste of money and Americans are not safer because we're funneling millions of dollars to Palantir. reply bane 6 hours ago | link I messed around with the demo they used to have on their website. It seems to be very much an answer to the 9-11 failure to connect the dots problem. Unify search, build semantic links. It was a very manually intensive tool based on what I saw. Very little automation, more like those pictures and strings you see in crime shows on TV...but on a computer. reply arikrak 7 hours ago | link How do they get such precise prices? If I was selling something for 140k, I would sell it for 140k. But they sell it for $141,015.42. reply pvarangot 6 hours ago | link It's GSA price. My guess is the retail price is somewhat rounder, and after tax and other specific discounts it comes down to that. reply m0nastic 5 hours ago | link Strictly speaking, being on the GSA schedule and being able to offer products/services for sale to the federal government requires that you not sell that product/service anywhere else for less than that GSA price. This is actually one of the reasons that doing business with the government is less lucrative than the commercial industry (for products and services which are comparable, many are things only sold to the government, so there is no hesitation about pricing them through the roof). As you can imagine, one of the ways that duplicitous federal contractors get around the idea of having to sell to the government for less than their normal prices is to structure their products/services as different (and therefore not apples to apples comparable). I still would bet that the price that they charge Goldman Sachs (just as an example, I don't actually know which investment banks are using their product) is higher than what they charge for any individual government client. Also, I think it's probably worth noting that the maximum addressable customer base for their products for federal agencies is way smaller than the equivalent number of financial customers. There's really only a handful of agencies that have this capability (I'd guess more than a handful, but probably less than a dozen). reply tptacek 6 hours ago | link Yes: GSA prices are IIRC the result of a pro-forma (and totally BS) discounting process. reply phmagic 10 hours ago | link pretty affordable compared to most enterprise software packages reply bicknergseng 10 hours ago | link "per core" reply trhway 9 hours ago | link with 90 days warranty :) Can it rot? Anyway, from their Gotham page https://www.palantir.com/palantir-gotham/ "Working closely with the customer, our engineers integrate and map all of the relevant source data—regardless of type or volume—into a single, coherent model. ... Once the model has ted, data flows continuously from its sources into the Palantir Gotham platform. ... They can search across all of their data sources at once, visualize relationships, explore divergent hypotheses, discover unknown connections, " Pretty much my 2009 pitch, and in the hindsight i see that my main weakness was that i couldn't even imagine $150K/core. Man, it is imagination what separates losers from winners! :) reply sz4kerto 8 hours ago | link kdb, a database engine I consider extremely simple compared to Palantir costs $50k/yr/core. reply mmcclellan 4 hours ago | link simple but competent for time series. and the 32-bit version is at least available for free now. reply xacaxulu 8 hours ago | link So Palantir is hiring if you have a clearance :-). Time to get your tax dollars back. Looks like SAIC all over again. reply xamdam 6 hours ago | link You don't need a clearance. We have large commercial deployments. reply bane 4 hours ago | link I did some consulting work with the NYPD and heard you guys also have some deployments with them and other large police forces. Those are nice non-clearance, but cool, jobs as well. reply

1 0

Apple Tim Cook re NSA etc on Charlie Rose
by grarpamp 17 Sep '14

17 Sep '14

http://www.zdnet.com/apple-ceo-tim-cook-on-snowden-surveillance-sweatshops-… http://www.zdnet.com/apple-ceo-tim-cook-on-secret-products-steve-jobs-ibm-d… http://charlierose.com/

2 1

Fwd: [liberationtech] proof of tampering
by coderman 16 Sep '14

16 Sep '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Tue, 16 Sep 2014 14:26:50 -0700 Subject: Re: [liberationtech] proof of tampering On 9/16/14, Jonathan Wilkes <> wrote: > ... over a year after the initial Snowden-leak stories-- I'm curious if > anyone has references to articles or papers that have researched and > reproduced any of these exploits to show how they are used in practice to > steal data, surveil, etc. it is very difficult finding detailed, public research into this particular type of offensive reversing. public knowledge is constrained by: - lack of access. see list history regarding ability to even detect/observe the most advanced attacks. this is changing, however. c.f.: exposure of corporate level, middle school type contract kit: https://wikileaks.org/spyfiles4/ and the work of Morgan Marquis-Boire. The Stuxnet/Flame/Guass/Duqu/Skywiper/Mahdi analysis are still the only views of TAO/NSAlike campaigns. corrections welcome ;) - lack of skills+/-experience spanning domains required to dissect the attack across its many pivoting boundaries of enabling and transiting through hardware, devices, networks, and systems under attack. [a redditor could do a shiny graph showing how nearly every technologist with the expertise for world class malware analysis ends up under secret contract, private contract, or does something else outside of university, to varying proportions of each.] - lack of interest or time; the small subset left in consideration is only human, and a thorough reverse analysis of complex stealthy code eats your life in quarter or full years chunks. a passion for the subject only carriers so far... finally, to underscore the point as is so conveniently at fingertip, your mail immediately went to the spam trap, having violated who knows what in googbrain to indicate forgery or malicious intent. why aggressively stamp down a narrative when you can slowly bleed it into silent not-existing instead? good luck, and best regards,

1 0

Assange AMA on Reddit
by Eugen Leitl 16 Sep '14

16 Sep '14

https://www.reddit.com/r/technology/comments/2ghp54/i_am_julian_assange_ama…

2 1

About STELLARWIND and other mysterious classification markings
by coderman 15 Sep '14

15 Sep '14

http://electrospaces.blogspot.nl/2014/09/about-stellarwind-and-another.html [ ... a good read; go do so now! ] for the TL;DR crowd: """ In the end, it doesn't make much difference whether STELLARWIND is a control system on its own, or a sub-system of COMINT, but it is remarkable that for such an important program, the people involved apparently also weren't clear about it's exact status and how to put it in the right place of a classification line. More important though is that the declassified documents show that besides the STELLARWIND program, there's at least one COMINT-compartment with at least one sub-compartment that protect similar or related NSA collection efforts which are considered even more sensitive, but about which we can only speculate. """

1 0

Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks
by coderman 15 Sep '14

15 Sep '14

direct draft at: https://www.rfc-editor.org/rfc/rfc7359.txt -------- Forwarded Message -------- Subject: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Date: Tue, 26 Aug 2014 18:23:00 -0700 (PDT) From: rfc-editor(a)rfc-editor.org Reply-To: ietf(a)ietf.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: drafts-update-ref(a)iana.org, rfc-editor(a)rfc-editor.org A new Request for Comments is now available in online RFC libraries. RFC 7359 Title: Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Author: F. Gont Status: Informational Stream: IETF Date: August 2014 Mailbox: fgont(a)si6networks.com Pages: 12 Characters: 26506 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-vpn-leakages-06.txt URL: https://www.rfc-editor.org/rfc/rfc7359.txt The subtle way in which the IPv6 and IPv4 protocols coexist in typical networks, together with the lack of proper IPv6 support in popular Virtual Private Network (VPN) tunnel products, may inadvertently result in VPN tunnel traffic leakages. That is, traffic meant to be transferred over an encrypted and integrity- protected VPN tunnel may leak out of such a tunnel and be sent in the clear on the local network towards the final destination. This document discusses some scenarios in which such VPN tunnel traffic leakages may occur as a result of employing IPv6-unaware VPN software. Additionally, this document offers possible mitigations for this issue. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/rfc.html Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

SpyFiles 4
by coderman 15 Sep '14

15 Sep '14

"Today, 15 September 2014, WikiLeaks releases previously unseen copies of weaponised German surveillance malware used by intelligence agencies around the world to spy on journalists, political dissidents and others." - https://wikileaks.org/spyfiles4/index.html get it while it's hot!

1 0

DOE quantum encryption & Google quantum computation research
by Gregory Foster 11 Sep '14

11 Sep '14

GCN (Sep 10) - "DOE, Google [independently] back quantum computing research": http://gcn.com/blogs/pulse/2014/09/doe-google-quantum.aspx > The Department of Energy is investing in a project to speed the development of unhackable quantum encryption technology that will protect the country's power grid from cyberattack. > > Under the DOE's Cybersecurity for Energy Delivery Systems program, the nation's top program for grid security, San Diego startup Qubitekk was awarded $3 million to work in partnership with Oak Ridge National Laboratory, Pacific Northwest National Laboratory, the University of Texas at Austin, Sandia National Laboratory and Pacific Gas & Electric to develop practical quantum security for the nation’s power grid. > > Qubitekk, founded in 2012 to commercialize technology required to speed the adoption of quantum computing, recently announced the availability of the world's first plug-and-play entangled photon generator, the QES1. Like the transistors at the hearts of classical computers, the QES1 enables the flow of information through quantum computers and quantum encryption products – both of which the company is currently developing. > > Meanwhile, Google is planning to build its own quantum computer. The Quantum Artificial Intelligence team at Google is launching a hardware initiative to design and build new quantum information processors based on superconducting electronics, according to a Google+ post by the lab team. Google also announced that John Martinis and his team at UC Santa Barbara will join Google in the initiative. > > Google has been working with D-Wave Systems, maker of the quantum computer being tested by the Quantum Artificial Intelligence Lab at NASA’s Ames Research Center. Martinis will try to make his own versions of the kind of chip inside a D-Wave machine. > > The Google Quantum AI team will test “new designs for quantum optimization and inference processors based on recent theoretical insights as well as our learnings from the D-Wave quantum annealing architecture,” Google said. The company will continue to work with D-Wave scientists and to experiment with the 512-qubit “Vesuvius” machine at NASA Ames that will be upgraded to a 1000 qubit “Washington” processor. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 0

Obituary: Hal Finney | The Economist
by Robert Hettinga 10 Sep '14

10 Sep '14

http://www.economist.com/news/obituary/21615469-harold-finney-futurist-and-… Hal Finney AS IT turned out, Hal Finney was not Satoshi Nakamoto. But for a short while, at least, some people thought he might be. “Satoshi Nakamoto” is the most famous non-person on the internet. The name is a pseudonym, meant to hide the shadowy programmer (or programmers) behind Bitcoin, a computerised currency designed to liberate money from the control of any central bank. Speculating about his true identity is a popular pastime in some of the more esoteric corners of the web. Still, Mr Finney was a good guess. As a cryptographer and a programmer he had the skills, for Bitcoin relies on cryptography to function. Having been an early adopter (he was, with the fabled Mr Nakamoto, a partner in the world’s first ever Bitcoin transaction) he certainly had the pedigree. And he had the beliefs, too. He was one of the original “cypherpunks”, a small, influential band of cryptographers, philosophers and programmers who, in the early 1990s, helped stamp the early internet with its culture of rebelliousness, distrust of government and optimistic belief in the liberating power of technology. Two decades before Edward Snowden put the subject on front pages the world over, the cypherpunks were discussing how the coming age of the internet would allow governments and companies to pry ever more deeply and easily into the lives of their citizens and customers. But that same computer revolution would also hand ordinary people the power to fight back against the organisations that presumed to run their lives. Until that point, good quality encryption had been something available only to spy agencies and big companies. Computers would give people the power to carve out a mathematically guaranteed refuge from the powers that be, and to have a conversation that was provably, reliably private. For Mr Finney, who had spent his high-school years imbibing the supercharged libertarianism of Ayn Rand, and who was now earning a living writing video games, that was a heady challenge. He accepted it with gusto. “Here we are faced with the problems of loss of privacy, creeping computerisation, massive databases, more centralisation,” he wrote. “[But] the computer can be used as a tool to liberate and protect people, rather than to control them.” His aim was clear: “The work we are doing here, broadly speaking, is dedicated to this goal of making Big Brother obsolete.” He began helping, unpaid, with a program called Pretty Good Privacy (PGP), putting in enough hours that it became a second job. It was well-named: even today, messages scrambled with it are thought to be unbreakable (Mr Snowden used PGP for his e-mail exchanges with the journalists to whom he leaked his documents). In 1991 Phil Zimmermann, PGP’s chief developer, uploaded it to the internet. America’s spies were aghast. Exporting encryption—which was classed as a weapon—was illegal. And here a group of self-proclaimed techno-liberators were proposing to just hand it over to anyone in the world—diplomat, criminal, teenager—who wanted it. When the legal kerfuffle died down, Mr Zimmermann hired Mr Finney as his new company’s second-ever employee. Suspended animation For a long time he ran a free “remailer”, a server designed to forward e-mail anonymously, no questions asked, to anyone in the world. Whose business was it, after all, what people wanted to send to each other, except the sender and the recipient? His interests extended beyond privacy. He was fascinated by the sorts of futures that technology might unlock, speculating about everything from how morals evolve in rich societies to when clean energy might finally displace fossil fuels. Away from the screen, he was chatty and gregarious, a keen skier and runner. He had to stop in 2009, when he was diagnosed with motor neurone disease (MND). The illness gradually paralyses its victims, but, with characteristic logic, Mr Finney pointed out that it was not a death sentence—even when those muscles necessary for breathing gave out, life could carry on with the aid of a mechanical ventilator. He was surprised, he said, to discover that most people with the disease “chose” death instead. After all, MND robs sufferers only of their bodies, not their minds, and for him it was the mind that mattered. His interests went beyond computers and coding, to sociology, psychology and how technology might improve society. As long as there was a way to communicate with the outside world—even if it was only by having a computer interpret the twitchings of a facial muscle—he wanted to endure. When even that became difficult, he put a final plan into action. In accordance with his wishes, he was disconnected from his ventilator. As soon as he had been declared legally dead, technicians from a firm called Alcor froze his body in liquid nitrogen. He became one of a few hundred people who have elected to have their bodies stored until medicine advances to the point where it can safely revive them and cure their original ailments. It sounds (and is) science-fictional, and Mr Finney was under no illusions about the prospects of waking up again. But placing his faith in a technology that has yet to be invented was a rational gamble for a committed techno-optimist. And besides, a slim hope is better than none at all.

1 0

Hal Finney cryopreserved
by Eugen Leitl 10 Sep '14

10 Sep '14

http://lists.extropy.org/pipermail/extropy-chat/2014-August/082585.html Max More max at maxmore.com Thu Aug 28 18:41:54 UTC 2014 Previous message: [ExI] It's alive? Next message: [ExI] Hal Finney being cryopreserved now Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] I am both sad and happy to tell you that long-time Extropy Institute/Extropy magazine/Extropy chat list member -- and honored cypherpunk and Bitcoin pioneer – was declared clinically dead this morning and is now being cryopreserved. Hal was diagnosed with ALS five years ago. He made it clear that once he lost the ability to communicate, he did not want his vital functions supported any further but should be allowed to cease functioning and promptly be cryopreserved. Hal and Fran Finney arrived in Scottsdale, Arizona on Tuesday where he was checked into ICU of a hospital near Alcor. After administration of drugs to ensure no consciousness, his ventilator was removed. Although the doctors expected all breathing to cease within an hour, Hal’s body kept going until shortly before 9:00 am this morning, August 28, 2014. Immediately after pronouncement of legal death, Alcor’s standby team went into action, restoring circulation, ventilation, administering an array of medications, and initiating external cooling. Surgery is currently underway to enable us to replace Hal’s blood and interstitial fluids with cryoprotectant. Once perfusion is finished we will be able to plunge Hal’s temperature down past the freezing point without any significant ice formation. Once he is down to around -110 degC we will slow cooling and take a couple more days to reach the final storage temperature of -196 degC. After that, Hal will be placed in long-term storage and cared for until the day when repair and revival may be possible. Hal’s wife, Fran (also an Alcor member) has stayed by Hal’s side throughout and is observing our procedures firsthand. Since Hal is open about his Alcor membership and said that he would be happy for us to tell people about his choice if it might be good for cryonics, we will be issuing a press release, as well as writing something more extensive for *Cryonics* magazine and elsewhere. If you have thoughts on Hal and his life and work, please send them to me. Hal, I know I speak for many when I say that I look forward to speaking to you again sometime in the future and to throwing a party in honor of your revival. --Max -- Max More, PhD Strategic Philosopher Co-editor, *The Transhumanist Reader* http://www.amazon.com/Transhumanist-Reader-Contemporary-Technology-Philosop… President & CEO, Alcor Life Extension Foundation

2 1