- cypherpunks - lists.cpunks.org

HackRF will likely start shipping in August
by Eugen Leitl 23 Jul '14

23 Jul '14

(the tinfoilhatterati will understand and rejoice) https://greatscottgadgets.com/hackrf/ HackRF One is now available for pre-order from: HakShop (US) NooElec (US/CA) Hacker Warehouse (US) Ada's Technical Books (US) Wall of Sheep (US) Store4Geeks (SE) Passion Radio Shop (FR) Passion Radio Shop UK (UK) TAPR (US) iSource Asia (CN) WiMo (DE) Pre-ordered units will ship immediately after all rewards have shipped to Kickstarter backers, estimated July 2014. For the latest information on development and manufacturing, follow the Kickstarter updates.

3 2

web based shared secret symmetric encryption application
by Cryptoparty Marseille 22 Jul '14

22 Jul '14

Hi! I'm looking for a decent free and open source application that would work similarly to "Hushmail Express message" (https://help.hushmail.com/entries/351388-I-have-received-an-encrypted-email…) that would allow me to deposit an encrypted message on an apache web server that would be decrypted by the recipient using a shared secret (that's already established, so I don't need a key exchange mechanism). I read Tony's posts and his blog article (http://tonyarcieri.com/whats-wrong-with-webcrypto) and I'm well aware that browser based encryption is not optimal but I'm just looking for something slightly more secure than plain text email that could be used by an end user not willing to install GPG, not an NSA proof secure system. The (apache2/debian7) web server is physically under my control, I'm the only root (I hope! :-) and SSL/TLS is enabled. Thanks for your advice. cryptomars

3 2

Fwd: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws
by coderman 22 Jul '14

22 Jul '14

thanks Eugen! ---------- Forwarded message ---------- From: Eugen Leitl <eugen(a)leitl.org> Date: Tue, Jul 22, 2014 at 1:30 AM Subject: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws To: tor-talk(a)lists.torproject.org, Liberation Technologies <liberationtech(a)lists.stanford.edu> https://www.techdirt.com/articles/20140721/11362227955/carnegie-mellon-kill… Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws from the questionable-legality dept There's some buzz in security circles today after it came out that a session at the upcoming Black Hat Conference entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" by Michael McCord and Alexander Volynkin (both of whom work for Carnegie-Mellon University and CERT) had been pulled from the conference at the request of CMU. A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. There's been plenty of speculation about what's going on, but Chris Soghoian has a pretty good thesis that the researchers likely didn't have institutional approval or consent of the users they were identifying, meaning that they were potentially violating wiretapping statutes. As he notes, running a Tor server to try to spy on Tor traffic without talking to lawyers is a very bad idea. While it hasn't yet been confirmed that this is what happened, it certainly is a pretty sensible theory. Of course, none of that changes the fact that it's possible to identify some Tor users. But... that's also not particularly new. In fact, we've discussed in the past how the feds can identify Tor users. Tor adds an important layer of protection, but there are plenty of ways that you can still be identified while using Tor. Just ask Russ Ulbricht. The problem isn't so much Tor itself but how people use it -- and the simple fact is that most people use it in a way that will eventually reveal who they are. While it's not definite, it seems likely that this is what the talk would have revealed. Shutting it down wasn't any sort of big attempt to cover up this fact, but perhaps it was to protect the researchers and CMU (potentially) from a lawsuit for violating wiretapping laws.

2 1

shipment interdiction [was: BadBIOS forensics]
by coderman 21 Jul '14

21 Jul '14

On Wed, Jul 16, 2014 at 4:19 AM, Bluelotus <bluelotus(a)openmailbox.org> wrote: > ... > My laptops were indicted, infected and implanted. and now they're getting thoroughly cleaned, see attached. please note for all future reference that suspect materials should be delivered in person, even at cost of a plane ticket. so much for that inquiry, :/ best regards, (attached interdiction of shipment from Washington State to Oregon via Florida - usually they at least try to make it look plausible, heh) https://peertech.org/files/fedex-fail.jpg

2 2

Re: [liberationtech] Foxacid payload
by coderman 21 Jul '14

21 Jul '14

On Thu, Jul 17, 2014 at 12:19 PM, Andy Isaacson <adi(a)hexapodia.org> wrote: > ... > And once you've patched this bug, FOXACID will update to issue another > 0day. > > It's worth doing, for sure! Patching bugs makes us all incrementally > safer. > > But don't pretend that patching the specific attack your adversary is > currently using will disable or even seriously inconvenience the > adversary. this is exactly why some who have received these payloads are sitting on them, rather than disclosing. it is more useful to mitigate privately, and observe how/when an exploit is used, than burn it publicly for zero effective security improvement. (the less scrupulous would sell to highest bidder for other clandestine hacks) better ideas welcome! best regards, -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

2 1

potential leak on Torpedo
by Eugen Leitl 21 Jul '14

21 Jul '14

https://pay.reddit.com/r/TOR/comments/2b8oq3/please_read_if_you_usedepend_o… Please read if you use/depend on Tor. Never before seen FH information. (self.TOR) submitted 16 hours ago * by Deepthroat2 [+1] Hello everyone, I have some information that I have been dying to share for months, but due to the circumstances, and to avoid detection, I had to wait for some time before I was able to safely make this post. My goal here is to provide information that I know is credible and for the Tor community to use it as they see fit, due to the nature of my work, and the severe penalties associated with breaking the rules and giving out information you aren't supposed too, I have no way of verifying or proving anything to you that I say here, I understand if find me less than credible, however, this is essentially a PSA, and you can take it for what it's worth to you. Just about one year ago, the Tor community was shaken by a Firefox exploit which utilized a javascript exploit and an old vulnerbility in the Tor Browser Bundle to unmask some users of Freedom Hosting. There has been rampant misinformation, and speculation to the point that I felt like pulling my hair out, or just simply bursting out into laughter when reading some of the outlandish claims made by people who have little to no idea what they are talking about. Today, I will set the record straight. The FH exploit was a government engineered, and deployed exploit that was designed in response to former Director Mueller's fustration at an earlier child pornography case in which the FBI was ridiculed for being unable to ascertain the source of child pornography, for those who aren't familiar with this case, it involved a man who had accessed child pornography by accident on a Tor hidden service, and then brought his desktop computer to the office, explaining what had happened and that he subsequently preformed a "Full wipe" on the disk. The agent who took the report had limited knowledge about Tor, however, at the time he knew that any directed effort to identify a specific Tor user was hopeless, and in the report he indicated that "There is currently no known way to ascertain the location of a Tor user, thus, no investigative leads exsist." This got leaked to the press, and they had a field day, hinting at the incompetency of the Bureau. Needless to say, the FBI had it's ego hurt quite badly by this public display of incompetency. Then Director Mueller directed the CEOS (Child exploitation and obscenity section) to find a way to penetrate the layers of protection provided by Tor, and to come up with a fesible way to conduct a sting operation in order to bring these people to justice. The FBI had previously conducted a sting on viewers of child pornography in a case out of Nebraska, that resulted in the arrest of about 25 people. This was the first successful take down of CP consumers that were utilizing a Tor hidden service. One of the errors that I see alot on these forums and others was that the Nebraska take down was done in a similar fashion to the FH exploit, with the code being deployed onto the pages of the boards, however, this is not the case. From my understanding, the Nebraska field office was able to find the actual server, take it over covertly, then upload a series of files that purported to be child pornography, but actually contained nothing but encrypted gibberish. They were video files that were embedded with code that called back to a computer that recorded the IP address of the requestor, date and time similar to the way windows media player attempts to recall album information and cover art for music cds and such. These were files that the user actually had to download and attempt to open. This is why the service was run for weeks, and only 25 people were identified as users. This method was described by the techs who deployed it as a "NIT" or "Network Investigational Tool". Now for Freedom Hosting.... The javascript exploit could not be deployed directly on the servers which Mr. Marques was using due to either technical reasons, or legal requirements by the AUSA in Maryland. So the decision was made to clone the services exactly, and transport then to the home of the FBI CEOS in the Greenbelt division of Maryland. This location was picked specifically because sentencing in this district for Child Pornography crimes is more severe. It was July 31st of 2013 when the exploit actually went live, and tried to identify criminals. It was installed previously, however, there were technical problems early on and the code had to be revised 3 times before it was running as intended, it ran for about 11 days before being shut down. The amount of people identified by this exploit is still a closely gaurded secret, with only agents having a direct "Need to know" being privy to this information. Howver, the victory dance was short lived as news started flowing around that the evidence may not be admissible in court, due to the manner in which it was collected, among other reasons. Although proper warrants were issued, it would take atleast 4-7 years to comb through the list of suspects, and question, arrest each one. The major problem is that after about 12 months, the courts start to presume your evidence is prejudicial to the defendant because you're supposed to have an indictment and serve it on the defendant within 30 days, and that just wasn't possible. You can request an extension of this time, however you must present a new, fresh reason for doing so..."We still aren't ready" doesn't cut it. There is no statue of limitations for the crime of "Accessing with intent to view child pornography" so barring any other limitations, the FBI can come after someone 10-15 years later. The AUSA became uncomfortable with the prospects of his legal case against the exploitees of FH and went to the US Attorney. There was disagreement as to whether or not the evidence would be viable, however, the operation went on anyways. One of the victims of the FH exploit was a man by the name of Grant Klein from Vermont. The Bureau had made arrangements with the local police for assistance with the raid (This is pretty much standard operation procedure, and is done for the saftey of the agents, as well as to maintain professional courtesy. Local cops get butt hurt when you arrest people on their turf without them knowing). The FBI had provided the local police with court documents and the affidavit of arrest regarding the cirsumstances of Mr. Klein's warrant, which they promptly posted onto their press release against the wishes of the FBI. This resulted in the termination of atleast one employee from local PD. He was raided and before even being asked a question ,he began spewing a confession. His home was searched, and a desktop computer with no hard disk was found, as well a laptop computer belonging to his wife Susan. There was no illegal materials found on these, however, he had a smartphone in the drawer of a nightstand which contained illegal images of minors. He was arrested and charged with 3 seperate crimes. To make a long story short, the FH related charges were dropped because the FBI had crossed a legal line by offering up child pornography de novo, by shutting down the server, then bringing it back online hosting real CP. They were uncomfortable with the prospects of this case, and were able to use a leon good faith exception to admit the evidence they found on his phone to make a single possession charge stick, however, he agreed to plead guilty. The rest of the leads which lead to foreign nationals were then distributed accordingly to the various LEA's. Also, earlier this wekk, the UK police arrested 660 people as part of Operation Notarise. The operation name of the FBI takedown in Nebraska was "Operation Torpedo" This was a cute poke at both the method they used, and the users they targeted Torpedo - Navy missile Tor Pedo - Tor Pedophile. -DT moar comments on Reddit

1 0

Huge collection of Security Data Science papers
by Eugen Leitl 21 Jul '14

21 Jul '14

(looks useful) https://pay.reddit.com/r/netsec/comments/2b8pk2/huge_collection_of_security… Over the past several years I have collected and read many security research papers/slides and have started a small catalog of sorts. The topics of these papers range from intrusion detection, anomaly detection, machine learning/data mining, Internet scale data collection, malware analysis, and intrusion/breach reports. I figured this collection might useful to others. All links lead to PDFs hosted here. I hope to clean this up (add author info, date, and publication) when I get some more time as well as adding some detailed notes I have on the various features, models, algorithms, and datasets used in many of these papers. Here are some of my favorites (nice uses of machine learning, graph analytics, and/or anomaly detection to solve interesting security problems): CAMP - Content Agnostic Malware Protection Notos - Building a Dynamic Reputation System for DNS Kopis - Detecting malware domains at the upper dns hierarchy Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis Polonium - Tera-Scale Graph Mining for Malware Detection Nazca - Detecting Malware Distribution in Large-Scale Networks PAYL - Anomalous Payload-based Network Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Here is the entire collection: Intrusion Detection A Close Look on n-Grams in Intrusion Detection- Anomaly Detection vs. Classiﬁcation A Kill Chain Analysis of the 2013 Target Data Breach A Lone Wolf No More - Supporting Network Intrusion Detection with Real-Time Intelligence A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Acquiring Digital Evidence from Botnet Attacks: Procedures and Methods (PhD Thesis) ALERT-ID - Analyze Logs of the network Element in Real Time for Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Anomaly-based Intrusion Detection in Software as a Service Back to Basics - Beyond Network Hygiene Beehive - Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces Beheading Hydras - Performing Effective Botnet Takedowns Bloodhound - Searching Out Malicious Input in Network Flows for Automatic Repair Validation Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling CAMP - Content Agnostic Malware Protection Casting out demons - Sanitizing training data for anomaly sensors CloudFence - Data Flow Tracking as a Cloud Service Comparing anomaly detection techniques for HTTP Cujo - Efficient detection and prevention of drive-by-download attacks Decoy Document Deployment for Effective Masquerade Attack Detection Detecting Spammers with SNARE - Spatio-temporal Network-level Automatic Reputation Engine Detecting Unknown Network Attacks Using Language Models Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis Effective Anomaly Detection with Scarce Training Data Efficient Multidimensional Aggregation for Large Scale Monitoring EFFORT - Efficient and Effective Bot Malware Detection ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates - slides ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis FiG - Automatic Fingerprint Generation Filtering Spam with Behavioral Blacklisting FLIPS - Hybrid Adaptive Intrusion Prevention HMMPayl - An Intrusion Detection System Based on Hidden Markov Models Kopis - Detecting malware domains at the upper dns hierarchy Large-Scale Malware Analysis, Detection, and Signature Generation Leveraging Honest Users - Stealth Command-and-Control of Botnets - slides Leveraging Honest Users - Stealth Command-and-Control of Botnets Local System Security via SSHD Instrumentation Machine Learning In Adversarial Environments Malware vs. Big Data (Umbrella Labs) McPAD - A Multiple Classifier System for Accurate Payload-based Anomaly Detection Measuring and Detecting Malware Downloads in Live Network Traffic Mining Botnet Sink Holes - slides MISHIMA - Multilateration of Internet hosts hidden using malicious fast-ﬂux agents Monitoring the Initial DNS Behavior of Malicious Domains N-Gram against the Machine - On the Feasibility of the N-Gram Network Analysis for Binary Protocols Nazca - Detecting Malware Distribution in Large-Scale Networks Netgator - Malware Detection Using Program Interactive Challenges - slides Network Traffic Characterization Using (p, n)-grams Packet Representation Notos - Building a Dynamic Reputation System for DNS On the Feasibility of Online Malware Detection with Performance Counters On the Infeasibility of Modeling Polymorphic Shellcode On the Mismanagement and Maliciousness of Networks Outside the Closed World - On Using Machine Learning For Network Intrusion Detection PAYL - Anomalous Payload-based Network Intrusion Detection PAYL2 - Anomalous Payload-based Worm Detection and Signature Generation Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware Practical Comprehensive Bounds on Surreptitious Communication Over DNS - slides Practical Comprehensive Bounds on Surreptitious Communication Over DNS Privacy-preserving Payload-based Correlation for Accurate Malicious Traffic Detection Revealing Botnet Membership Using DNSBL Counter-Intelligence Revolver - An Automated Approach to the Detection of Evasive Web-based Malware Self-organized Collaboration of Distributed IDS Sensors SinkMiner- Mining Botnet Sinkholes for Fun and Profit Spamming Botnets - Signatures and Characteristics Spectrogram - A Mixture of Markov Chain models for Anomaly Detection in Web Traffic The Security of Machine Learning Toward Stealthy Malware Detection Traffic Aggregation for Malware Detection Understanding the Domain Registration Behavior of Spammers Understanding the Network-Level Behavior of Spammers VAST- Network Visibility Across Space and Time Malware A static, packer-agnostic filter to detect similar malware samples A study of malcode-bearing documents A survey on automated dynamic malware-analysis techniques and tools APT1 Technical backstage (malware.lu hack backs of APT1 servers) Automatic Analysis of Malware Behavior using Machine Learning BitShred - Fast, Scalable Code Reuse Detection in Binary Code BitShred - Fast, Scalable Malware Triage Deobfuscating Embedded Malware using Probable-Plaintext Attacks Escape from Monkey Island - Evading High-Interaction Honeyclients Eureka - A framework for enabling static malware analysis Extraction of Statistically Significant Malware Behaviors Fast Automated Unpacking and Classification of Malware FIRMA - Malware Clustering and Network Signature Generation with Mixed Network Behaviors FuncTracker - Discovering Shared Code (to aid malware forensics) - slides FuncTracker - Discovering Shared Code to Aid Malware Forensics Extended Abstract Malware files clustering based on file geometry and visualization using R language Mobile Malware Detection Based on Energy Fingerprints — A Dead End Polonium - Tera-Scale Graph Mining for Malware Detection Putting out a HIT - Crowdsourcing Malware Installs Scalable Fine-grained Behavioral Clustering of HTTP-based Malware SigMal - A Static Signal Processing Based Malware Triage Tracking Memory Writes for Malware Classification and Code Reuse Identification Using File Relationships in Malware Classification VAMO - Towards a Fully Automated Malware Clustering Validity Analysis Data Collection Crawling BitTorrent DHTs for Fun and Proﬁt CyberProbe - Towards Internet-Scale Active Detection of Malicious Servers Demystifying service discovery - Implementing an internet-wide scanner gitDigger - Creating useful wordlists from GitHub PoisonAmplifier - A Guided Approach of Discovering Compromised Websites through Reversing Search Poisoning Attacks ZMap - Fast Internet-Wide Scanning and its Security Applications (slides) ZMap - Fast Internet-Wide Scanning and its Security Applications Vulnerability Analysis/Reversing A Preliminary Analysis of Vulnerability Scores for Attacks in Wild Attacker Economics for Internet-scale Vulnerability Risk Assessment Detecting Logic Vulnerabilities in E-Commerce Applications ReDeBug - Finding Unpatched Code Clones in Entire OS Distributions The Classification of Valuable Data in an Assumption of Breach Paradigm Toward Black-Box Detection of Logic Flaws in Web Applications Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning - slides Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning Anonymity/Privacy/OPSEC/Censorship Anonymous Hacking Group – #OpNewblood Super Secret Security Handbook Detecting Traffic Snooping in Tor Using Decoys Risks and Realization of HTTPS Traffic Analysis Selling Off Privacy at Auction The Sniper Attack - Anonymously Deanonymizing and Disabling the Tor Network The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions - slides The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions Tor vs. NSA Data Mining An Exploration of Geolocation and Traffic Visualization Using Network Flows to Aid in Cyber Defense DSpin - Detecting Automatically Spun Content on the Web Gyrus - A Framework for User-Intent Monitoring of Text-Based Networked Applications Indexing Million of Packets per Second using GPUs Multi-Label Learning with Millions of Labels - Recommending Advertiser Bid Phrases for Web Pages Real-Time Handling of Network Monitoring Data Using a Data-Intensive Framework Shingled Graph Disassembly - Finding the Undecideable Path Synoptic Graphlet - Bridging the Gap between Supervised and Unsupervised Profiling of Host-level Network Traffic Cyber Crime Connected Colors - Unveiling the Structure of Criminal Networks Image Matching for Branding Phishing Kit Images - slides Image Matching for Branding Phishing Kit Images Inside a Targeted Point-of-Sale Data Breach Investigating Advanced Persistent Threat 1 (APT1) Measuring pay-per-install - the Commoditization of Malware Distribution Scambaiter - Understanding Targeted Nigerian Scams on Craigslist Sherlock Holmes and the Case of the Advanced Persistent Threat The Role of the Underground Market in Twitter Spam and Abuse The Tangled Web of Password Reuse Trafﬁcking Fraudulent Accounts - The Role of the Underground Market in Twitter Spam and Abuse CND/CNA/CNE/CNO Ampliﬁcation Hell - Revisiting Network Protocols for DDoS Abuse Defending The Enterprise, the Russian Way Protecting a Moving Target - Addressing Web Application Concept Drift Timing of Cyber Conflict –Jason @jason_trost SECURITYDATA SCIENCERES

1 0

Fwd: request for video and transcript - Fuckhackerfucks! An Audience Bashing
by coderman 21 Jul '14

21 Jul '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Mon, Jul 21, 2014 at 2:28 AM Subject: Re: request for video and transcript - Fuckhackerfucks! An Audience Bashing To: Rich Jones <miserlou(a)gmail.com> On Sun, Jul 20, 2014 at 8:41 PM, Rich Jones <rich(a)openwatch.net> wrote: > I was kind of disappointed by it.. normally Johannes is very funny, but this > was just kind of rambling Marxist SJW stuff without much imperative or > self-awareness.. or maybe the coffee hadn't hit me yet.. i expected nothing, and enjoyed a shared frustration. best regards, "This e-postcard powered by Google Wuffie" "This e-postcard best viewed in G+"

1 0

request for video and transcript - Fuckhackerfucks! An Audience Bashing
by coderman 21 Jul '14

21 Jul '14

the stream at http://new.livestream.com/internetsociety2/hopex2 less than optimal. "Johannes of art tech group monochrom will indulge in a public rant about hacker culture and why it has to be saved from itself." and other enumerated unusefullness :) [ no telling when http://store.2600.com/videos.html will update, BTC for digital please? ] --- speaking of Fuckyouhackerfucks, http://trouble.org/?p=1013 <him> do you even know what this is? <her> a bitcoin QRcode <him> ...

4 3

Re: [Cryptography] What has Bitcoin achieved?
by grarpamp 21 Jul '14

21 Jul '14

> This is wandering away from crypto No better way to naysay BTC than to break the crypto and wash everyone out. $Billions gone, and a permanent seat in the research hall of fame ;-) (BTW, where are the BTC insurance companies...) >> announced that they will not exceed 40%. Down from 55% to 32% now... > That's not surprising. Bitcoin is a speculative asset, and at this > point the Bitcoin fans have a shared interest in keeping its price up. > The story that nobody's in charge is one of the things that makes > people want to buy it, so, well, sure. In the admittedly unlikely > event that there are enough contracts or debts denominated in Bitcoin > that there were significant non-speculative demand, things could > change. I'd agree that actual market float outstanding is thin right now. Yet different from purely propping things up, speculation is all about assessing future value and making moves accordingly today... https://ciphrex.com/archive/bofa-bitcoin.pdf http://honestnode.com/bitcoin-fair-value-a-first-assessment/ http://www.coindesk.com/bitcoin-2014-report/ http://www.coindesk.com/state-of-bitcoin-q2-2014-report-expanding-bitcoin-e… > This is what's technically known as "marketing BS". Dell accepts > dollars. They have a deal with Coinbase in which Coinbase takes the > risk of raising dollars by selling Bitcoins in return for a commission Not so fast! Yes, Dell accepts dollars (subject to whatever BTC holdback they, like Overstock, may be specifying). However obtaining those dollars is totally dependant on Coinbase's ability to convert BTC to dollars on exchange or privately. And Coinbase is surely nowhere near whole enough from commissions to be able to back their contracts against any significant outstanding float in a long price dive situation. Therefore Dell *is* in the BTC game before dollars on these sales, regardless of the denomination they're booking. So is everyone else who 'accepts' BTC. Dell and others are large companies, with well paid accountants and lawyers... it takes more than whim of 'marketing BS' for them to put a BTC sticker on their door. >>> volatility > but if > there's another collapse in the Bitcoin market The BTC market has been in a fairly steady log uptrend over the long term. The 'collapses' people speak of are, in that context, spikes returning to normal. All new markets and properties undergo price discovery. It's a continual process. Ever watch the NYSE, it's volatile too. > the distributed notary idea seems likely to be useful for something There is no 'useful for this or useful for that' concerning things riding on top of this tech... the underlying model, including the social contract aspects, either works for all uses, or for none. It's either broken or it's not. > but it's never going to replace real money. Neither will credit/debit cards. Nor is your fiat paper of choice 'real money' either, it's just called money by default. (Probably because the next default, real property, is hard to fit in your pocket.) Digital currencies will, like 'money', operate in the layer above real property. Again, here's the recycle bin for your trash, this time I'll even waive the recycling fee... ;) btc:1C96B6DszNqnX4KRzveu6BKRuznmmdFhdm > On re, replies on: Ghash.io, 50%, takeovers, self regulation... 50% is not a magical binary breakpoint, it merely permits more influence as the share moves along the scale from 50% to 100%. Right now, the $130M plus expenses (or $27M plus for ghash) that is needed to reach 50% seems to not be worth it to anyone. Who is graphing the cost-to-50%? And the cost-to-50% to market cap, volume, and quantity ratios? Those would be interesting and important graphs to watch. $130M is nothing to someone who wants to own a currency. So why hasn't it happened to BTC yet? Perhaps because the value of BTC owes a lot to its decentralization. If so, and you take that away, you're risking your own value before you start. And risking an exodus fork. Just as easy as it was to add BTC to Dell's checkout in N days time, adding another currency is easy if yours (or your takeover) fails, or customers continue to demand a decentral one. And you're not going to win a takeover anyways because no one will tolerate you blocking their transactions... no entity survives having 50, 40, 30 percent of its users in abject protest against theft, loss of value and service, and principle. Among other things, you'd be prosecuted, sued, DDoS'd off the net, badmouthed, and forked against. Probably better to start your own digital currency and put $115M into marketing and $15M into central hardware. > Also, were such a thing in the works, I wouldn't count on the > people involved publicly broadcasting their intentions on Twitter. That only applies to mining 'companies'. Mining 'pools' derive their share from the users who elect to use them. Of course a pool could become a company. And a company could uphold the social contract. The Ghash was a remarkable social contract event by both shedding users and users leaving. It's happened before, and each time it does it underscores the importance of the contract to the currency to everyone involved. In the end, if anyone succeeds in taking/making any private/centralized coin, there will be some users who follow it, and some people who reject it in favor of other decentral coin. Digital banking and transacting has been done for decades. Banks could have made ACH/Wire compellingly attractive to users and the marketplace. But they waited, and didn't, and lost the chance... just like telcos lost the internet and music lost itself. As with those things, crypto in the 90's and overlay networks today, what is really being tested with BTC along with the tech, are meta concepts such as freedom, regulation, where value is stored, law, etc. At the moment it would be quite hard to say decentral digital currency is failing or holds little long term prospect. You can fund more drunken rambling here... :) btc:1D6rPeQUETfGpSp2JB2oojJUC8GiURyhp7

2 1