- cypherpunks - lists.cpunks.org

[16] technical footnote: möbius code
by brian carroll 05 Oct '13

05 Oct '13

// disclaimer: all my posts on cypherpunks are copyright-free... i just watched a video from the Numberphile on youtube and it perfectly captures a conundrum at the intersection of mathematics and language, in a context of communication and interpretation, as this involves read/write processing and potential errors or different pathways to grounding supposedly common [variables], as this also involves boundaries and limits and thresholds that influence it please watch the video before reading the analysis below, so as to consider the information prior to a particular evaluation of it: Politics and Numbers - Numberphile // 7:31 m http://www.youtube.com/watch?v=CfoKor05k1I ---- in the way that [categories] can move from one context of interpretation [A=A] into another [A->B'], so too it is possible that the relation to the data or variables in a given framework could exist in another framework, beyond a given boundary of presupposed interpretation. therefore, hypothetical issues of [skin cream] and [gun control] could be remapped into another context, via ambiguity and relations of observers, that is the dimensionality that potentially could be connected to the concepts in their {superposition}, and thereby euphemism could also exist as a subtext or subconscious or alternately referenced domain that is outside the "normal" interpretation yet still existent in terms of mapping into a shared meaning structure. in this way, responses equated with "correct answers" imply correctness in this secondary realm, as if grounded by the equations and their conclusions. in this way, referencing [cream] and [guns] could relate to sexual politics and their interpretation as well, as if part of the larger inherent dynamics of language as this influences and effects "variables" of math. that is, such parallel processing could be occurring beyond a given boundary, and be camouflaged or hidden by variables as a means of -secret communication- thus: the clear-answering via such quasi-computation that "skin cream is worse" and "ban on guns is better" has different political meaning when evaluated and recontextualized in this hidden framework, which may be the default situation for observer-observer communications, in shared unspoken frameworks. implicit yet operating beyond the given boundary, unlike, or stealth, though of a realm of shared consciousness in some domains and not others. this is indicated in an instance of double-talk (or perhaps there is a more effective word for this) when the narrator confirms YES-YES that his colleague is "good at math" when looking into the camera and then doing a second take- indicating "no", as if there is a parallel realm or juxtaposition in double- or triple-layers of meaning, that instance perhaps mathematic specific (e.g. good at math meaning can deduction of simple analysis (yes) versus literacy of mathematician (no) as a result of arriving at the correct answers, or interpretation). the inflexion then, when the narrator sums up that "there are people who do understand science perfectly well, who still let beliefs CLOUD their judgement", could be grounded in this 'other context' via its use as an analogy or metaphor, shifting or confirming a certain secondary or tertiary meaning that co-exists alongside or embedded or nested within the 'mathematical framework' that undergoes reasoning clash "processing" as if entirely 1:1 by default, even though having these paradoxical aspects of language that it is mediating, that are unstable, and 'multiple' in interpretation, which ground to different circuits or could be _ungrounded yet validated by this transference of 'proof' or 'correctness' via pseudo-mathematical analysis, a secondary reading inferred and -believed- as if primary, yet unchecked in its own framework of assumptions yet by default held as valid, due to its coherence as language via shared awareness, meaning, and thus TRUE by default of its being reasoned in these terms. a context of an educational classroom with a field of lavender chairs perhaps implying a royal instructional dimension, even, as part of an ideological predisposition to how information is transferred on several channels simultaneously, yet also secretly. in this way, so too, programming in relation to the [ideas] thus categorized and used for computation. the inherent potential for möbius code that turns a given interpretation inside-out or is transformed in some elusive way, where a boundary is surpassed yet there is no seeming accounting for its different from the inside. this is how observer-observer relations could occur, where there is discrimination occurring in a given context yet afforded plausible deniability as these issues can simply be denied or disallowed as part of the 'shared awareness'. it is also seemingly how code or programs could exist at other levels or have other unaccounted for functionality, given how they are interpreted and in what dimensions- based on what is shared awareness and shared as boundaries and consciousness. perhaps much goes unnoticed and much is allowed in this same way, as to social dynamics yet also brought into computational contexts, of reasoning and 'seeing' and observing and communication itself. so what if there are hidden rules traveling alongside a given communication exchange, and that these are oftentimes the primary language that is mediated by "equations" as it were, discourse or formulas- and yet it exists beyond an accounting in truth, of the actual issues mediated in this hidden way. to me that is the very basis for tyranny of A=B governing the ability to consider A=A relations, because it is the boundary that limits that consideration, and is ideological and beyond error-correction, functioning as dogma yet also, potentially, shared governing falsity that itself becomes infallible due to its existing in language, as code, or especially as a mathematical construct which actually is subjective and ungrounded. in this way the tyranny of mathematics and linguistics and their hidden service to political agendas, as programmed and codified and parsed, becoming platforms for the false-perspective, while the real reality is muted, unable to speak, deemed crazy to try to account for what is going on that is officially "missing", the hidden data and hidden viewpoints that corrupt and conspire towards certain opaque functioning, given perspective, literacy, boundaries. in other words, [ideas] that become programs and exist in computers are not error-checked or error-corrected at this level of accounting for their functioning, and this could be a realm of the security exploit or 'other coding' by default of the A=B difference in interpretation and this may be inherent and inescapable yet also could be designed for or around, yet requires modeling of paradox to do so, to address the contingencies of variables in their multiplicity. perhaps it is a cognitive exploit, the human processor and human computation that is the issue as it then may read/write or interact with, interpret, and parse other code, whether computer programs or others ideas-- yet the assumption should be this is an ungrounded observational position from the start, that so much is unaccounted for in basic relations, and so much is "believed" even in common terms without the ability to question conclusions or observations, which can skew to only certain predisposed beliefs- very likely due to limits and boundaries allowing for this. and thus the issue of infallible observers who by default may base relations and evaluations upon their unchecked through always already "true" viewpoints, itself is the basis for decentralized tyranny of 'shared beliefs' that by their being shared or confirmed, are equated with truth itself. illiteracy in this context not only involves bounded or limited analysis, it is also dangerous for others who may be silenced from this same activity, where the common false perspective rules and everyone must conform to unspoken yet actively communicated hidden agendas. thus, the mathematics can by default of their being related to and through, as interpreted language, be subjective and provide cover or a mask for other language, as a sign system that provides for such calculations to be confirmed, yet only in pseudo-truth. this is the essential corruption. and it appears to reside in individuals themselves as thinking and non-thinking beings, such that the integrity of an observation may not be required to exist within the observational self, instead it could be assumed a function of language and its external mediation even, 'over there'. in other words, 'errors in truth' may not be recognized or accounted for within the observer themselves, yet form the basis for shared observations with others in these secret or hidden channels in that their being shared is used to confirm their truth, via their usefulness. and yet the self is held beyond account for this, and can continue in error or unchecked in limited or warped or skewed interpretation, and this may be parallel to other observations or coincide with them, beyond a given boundary, where it is shared by some and unnoticed by others. yet this establishes the observer in this realm as an infallible viewpoint, which can then interpret or use structures parasitically while assuming equivalent deduction by inference, yet which would be ungrounded and pseudo-truth by default of its skewed accounting and not being testable or error-corrected in the terms it exists, and instead offer a one-way communication of "belief system" that is not held to any account, yet may govern over what equations can be utilized within what limits, while secretly exploiting them at the same time in this way. thus to propose this is the default situation, until made transparent, and ideas grounded otherwise- and all of this accounted for in modeling of language and mathematics, which until that point would be more false than true, given the probabilities involving continual use of shared frameworks of pseudo-truth that are detached from empirical accounting in the wider context of truth, thus tending toward zero and total falsity by these very same covert means. ad nihilism. 16 -> ig-noble

1 0

[Cryptography] System level security in "low end" environments
by John Gilmore 05 Oct '13

05 Oct '13

> b. There are low-end environments where performance really does > matter. Those often have rather different properties than other > environments--for example, RAM or ROM (for program code and S-boxes) > may be at a premium. Such environments are getting very rare these days. For example, an electrical engineer friend of mine was recently working on designing a cheap aimable mirror, to be deployed by the thousands to aim sunlight at a collector. He discovered that connectors and wires are more expensive than processor chips these days! So he ended up deciding to use a system-on-chip with a built-in radio that eliminated the need to have a connector or a wire to each mirror. (You can print the antenna on the same printed circuit board that holds the chip and the actuator.) What dogs the security of our systems these days is *complexity*. We don't have great security primitives to just drop into place. And the ones we do have, have complicated tradeoffs that come to the fore depending on how we compound them with other design elements (like RNGs, protocols, radios, clocks, power supplies, threat models, etc). This is invariant whether the system is "low end" or "high end". That radio controlled mirror can be taken over by a drive-by attacker in a way that would take a lot more physical labor to mess up a wire-controlled one. And if the attack aimed two hundred mirrors at something flammable, the attacker could easily start a dangerous fire instead of making cheap solar energy. (Denial of service is even easier - just aim the mirrors in random directions and the power goes away. Then what security systems elsewhere were depending on that power? This might just be one cog in a larger attack.) Some of the security elements are entirely external to the design. For example, is the radio protocol one that's built into laptops by default, like wifi or bluetooth? Or into smartphones? Or does it require custom hardware? If not, a teenager can more easily attack the mirrors -- and a corrupt government can infect millions of laptops and phones with malware that will attack mirror arrays that they come near to. For products that never get made in the millions, the design cost (salaries and time) is a significant fraction of the final cost per unit. Therefore everybody designs unencrypted and unauthenticated stuff, just because it's easy and predictable. For example it's pretty easy to make the system-on-chip above send or receive raw frames on the radio. Harder to get it to send or receive UDP packets (now it needs an IP address, ARP, DHCP, more storage, ...). Much harder to get it to send or receive *authenticated* frames or UDP packets (now it needs credentials; is it two-way authenticated, if so it needs a way to be introduced to its system, etc). Much harder again to get it to send or receive *encrypted* frames or UDP packets (now it needs keys too, and probably more state to avoid replays, etc). And how many EE's who could debug the simple frame sending firmware and hardware, can debug a crypto protocol they've just implemented (even making the dubious assumpion that they compounded the elements in a secure way and have just made a few stupid coding mistakes)? John _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

49 Page NSA analysis of Tor
by d.nix 05 Oct '13

05 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just published by Bart Gellman (Thanks Bart!): http://apps.washingtonpost.com/g/page/world/nsa-research-report-on-the-tor-… - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (MingW32) iQEcBAEBAgAGBQJSTy2TAAoJEDMbeBxcUNAePB0H/0MxORH4Gs7zIpIojhzKS9pE YPQ0SmbXqLRhPKjllSAi+e24gIDzaj8yBDF9GQwv68u5lNSca/PFK2TVugx7mG/9 chQkmQCvBVbrtQ1mhCReLWxh6NCpUgEvvCRi5ZtvqfqBzxE22exb7tsTetDDezLh jVmq9CFCXdkDN6yNuHZ/5lC17feMBPj6nNEAuCX99V1236N3dbe52/ZpSb8uzC/b bGBmiGecc71wM4dMhjRMBJjxz1dMmKW1cImIj5StPJkDOD3beDX6EP7XE94b0Ts2 JVRi+NFPCRKqMpLhwlvmx0WtH5pLbcoxUmBGP3/Q8r+dgWUXdv+8Z8FFpMaJPFQ= =LDCN -----END PGP SIGNATURE-----

2 1

Re: [tor-talk] Guardian Tor article
by Al Billings 05 Oct '13

05 Oct '13

What makes you think that Chromium would be more secure? — http://makehacklearn.org On Fri, Oct 4, 2013 at 7:11 PM, Moses <moses.mason(a)gmail.com="mailto:moses.mason@gmail.com">> wrote: NSA mainly attack TOR user (not TOR itself) by exploiting vulnerabilities in Firefox. Should devs consider to replace the browser in TOR bundle with other browsers (such as chromium)?

1 0

Injustice: Denial of Disservice Attack
by Jim Bell 04 Oct '13

04 Oct '13

"INJUSTICE: DENIAL of DISSERVICE ATTACK" or, "How to really mess up the opponent, and to do so legally" By Jim Bell, Author of 'Assassination Politics'. I spent well over 13 years in prison, and not only was I not guilty of nearly all of the crimes of which I was charged, I was actually a victim of crimes committed by various Federal government employees. Not only was I assaulted on November 25, 1997 by a government stooge and informant, Ryan Thomas Lund, in order to force me to accept a plea agreement in case 97-5270, Tacoma Federal Court, I was also the victim of an amazing forged (falsified; fictitious; fake) appeal case (Ninth Circuit Court of Appeals, case 99-30210) that was initiated by corrupt government and court employees, and whose pre-April-2000 existence was concealed from me until about June 2003. Naturally, I concluded that something must be done about this. The current population of United States Federal prisons is approximately 220,000 inmates. (In 1980, that population was about 20,000). Each year, somewhat more than 70,000 new defendants are charged, and the large majority (perhaps 95%) are convicted. Yet, you might be surprised: There are only about 3,500 Federal criminal jury trials in America each year. The reason for the apparent difference is that in the vast majority of such cases, the defendant or defendants accept a plea agreement, which the news media wrongly refers to as a 'plea bargain': In reality, it's not a 'bargain' for the criminal defendant, and it certainly isn't a 'bargain' for the American taxpayer. See the "Prisoner's Dilemma". It's actually a financial disaster of the first magnitude, one which the majority of the American population doesn't know about, and certainly doesn't understand. But the reason the defendants are motivated to accept those deals is simple: The Feds threaten them with time far greater than what they'll get if they deal. So, the very large majority of them deal. And so, all of us are poorer as a consequence. The average sentence, we can calculate, is 220,000/70,000, or a bit over 3 years per sentence. (This is one way to calculate an 'average sentence', there may be others.) It costs approximately $35,000 to keep a prisoner in Federal prison for one year. So, for the 220,000 current prisoners, that's a total cost of about $7.7 billion dollars. If that population could be brought down to the level it was in 1980, or 20,000 prisoners, about $7 billion dollars would be saved. Even better, it would be far harder to extort people, people such as Barrett Brown (journalist), Kim Dotcom (Megaupload), Bradley Manning (Cablegate), Ladar Levinson (operator of Lavabit), Edward Snowden (NSA leaker), Ty Warner (Beanie Babies, just convicted of tax evasion) or (now) Ross William Ulbricht, alleged operator of 'Silk Road'. And, of course, thousands more that are less well-known. Many of these people have either not committed any crime at all, or even if guilty of something, they shouldn't be punished to the extent the system would want to do. Or punished at all. I was pondering this problem in my prison cell one day, and I got yet one more of my 'awfully wonderful, wonderfully awful' ideas. (Quote from: "How the Grinch Stole Christmas") I was almost as energized, and as enthusiastic, as I was in early 1995, when I got the idea that I later turned into my "Assassination Politics" essay. I thought, what if every Federal defendant could be motivated to refuse to deal, to refuse to accept the deal that's usuallyoffered. The figure of$5,000 popped into my head. What if every Federal felony criminal defendant were offered money, let's say $5,000, if they would plead not-guilty (which is their Constitutional right) and to demand a jury trial (which is also their Constitutional right). The current system has trouble putting on 3,500 Federal felony criminal jury trials per year. How would that system increase that number significantly? The number of Federal courtrooms is somewhat fixed, the number of U.S. Attorneys is rather limited as well. And, Federal court time has to be shared with civil cases, too. So, it would be hard to imagine a great increase in the number of Federal criminal jury trials held. If the number of persons convicted could be dropped from 70,000 per year to 4,000 per year, that should save the American taxpayers well over $7 billion per year in prison and jail costs. Well over 90% of Federal prisons would have to shut within 5 years. How much would this cost? Well, assuming a cost-per-offer of $5,000, and perhaps 4,000 trials per year, the cost would be $20 million per year. For an individual, that's a lot of money. But for an entire country, that's peanuts. Yet, it would save the nation $7 billion. In other words, for every dollar offered to a criminal defendant, the savings to the public would be: $7 billion/$20 million = $350. These estimates are not set in stone. Of course, under this kind of pressure 'the system' would tend to allocate its resources, the limited number of courtroom-days available, and would probably select only the most serious cases for prosecution. So, while it's possible that some residual amount of plea-bargaining would remain, this same pressure would tend to force officials to accept that defendants serve smaller average sentences than they've been getting, which of course are already much lower than they'd probably like to get. Even if the resulting average sentence rose to 4 years, the overall population of Federal prisons would drop from 220,000 to about 16,000. (4 years x 4,000 trials/year). This would be a great improvement. The big question is, "Who would pay for this?". "Therein lies the rub", to quote Hamlet. Don't expect bigtime drug-dealers to donate: Their ability to make money would be thwarted if their products were rendered de-facto legal. However, illegal-drug users would be greatly benefited. The price of their favorite pastime might very well drop by a factor of 5-10, if the likelihood of getting arrested and charged with providing it was drastically lowered. That would surely occur if this system was expanded to include state jurisdiction, which is about 10x larger than the Federal system, and thus a cost 10x higher: $200 million per year.. Another group of people who would benefit would be tax-evaders. The Wikipedia article on "Tax Evasion in the United States" indicates that the approximate money 'lost' (and thereby gained by non-payers) is $305 billion in 2010. If only 1/100 of a penny foreach dollar thus saved was paid into a fund, that would be $30.5 million, which would be plenty to make sure that Federal tax evasion would be extremely difficult to prosecute. As well as every other Federal crime. Most accountants would see that as a good investment, and should advise their clients accordingly. Jim Bell

3 4

Deterministic Builds Part Two: Technical Details
by coderman 04 Oct '13

04 Oct '13

Mike Perry has just posted the second half of his reproducible builds effort: "Deterministic Builds Part Two: Technical Details - This is the second post in a two-part series on the build security improvements in the Tor Browser Bundle 3.0 release cycle." https://blog.torproject.org/blog/deterministic-builds-part-two-technical-de…

1 0

USB Block Erupters as RNG sources?
by Jim Bell 04 Oct '13

04 Oct '13

From: d.nix <d.nix(a)comcast.net> To: cypherpunks(a)cpunks.org; liberationtech(a)mailman.stanford.edu Sent: Thursday, October 3, 2013 9:11 AM Subject: Re: USB Block Erupters as RNG sources? > "Very little", and "no". They're basically custom Bitcoin-mining > ASICs, I looked at one a while back for use in password-cracking >> and they're really not suited for it at all, you load a vector in >> and say "go" but since they're quite I/O-limited you can't easily >> adapt them for hash-breaking. As for RNG use, they're entirely >> deterministic, how would you use them as an RNG source? >> at best you *might* be able twist it into a DRBG that would still >> need to be seeded (and regularly reseeded) with robust entropy. >> >> these ASICs really are single purpose; they're useless for anything >> else. >Thanks Peter, Coderman- >Kinda what I suspected seeing as they are *Application Specific* IC's >after all... Wishful thinking more than anything knowing that they are >now saturating their market and loosing value rapidly. >Cheers! >DN This looks like a decent idea for a RNG. http://www.sciencedirect.com/science/article/pii/S1434841111001713 Another is: http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=847868&url=http%3A%2F… Yet another: http://www.fdk.co.jp/cyber-e/pi_ic_rpg100.html Jim Bell

1 0

GCHQ report on 'MULLENIZE' program to 'stain' anonymous electronic traffic - The Washington Post
by d.nix 04 Oct '13

04 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GCHQ report on tainting Tor traffic: http://apps.washingtonpost.com/g/page/world/gchq-report-on-mullenize-progra… - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (MingW32) iQEcBAEBAgAGBQJSTy+dAAoJEDMbeBxcUNAer08H/2NRjQx8k/Wj/juvWKLoV1Q8 57VSYlUYpjDT6Ut7MoMPPDy2qhjPoFgUnJhvDMLgOrpGBXrjuO/6PgBLkPASRZUU /qQRsaGmiAmn8Inw2V097ISnoTBQlnjxjBIyPCKUh4mg0kRfZGcuTNWGlgTmL0hr b11+Th23afjpK9Ip+y9OvJykfdcOjoX11JQge9J4JmVwaNWmmFBj/u3DsgiCk6b7 U5F5Q5yIeQ8MhsucsOuvNbK7QQEZHdRbx7IqgHWxxu1JOTLLClOIkILoHbGUBOxj QMPw1EZAcBNx7Gmb8m4UU7DuPkAEXAcT/8ABd53MXE80rM6nqWgODC49rKa3Mvc= =8lpg -----END PGP SIGNATURE-----

1 0

[tor-talk] Guardian Tor article
by Eugen Leitl 04 Oct '13

04 Oct '13

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Fri, 4 Oct 2013 11:38:10 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] Guardian Tor article Message-ID: <20131004153810.GR31806(a)moria.seul.org> User-Agent: Mutt/1.5.20 (2009-06-14) Reply-To: tor-talk(a)lists.torproject.org Just to start off the new media frenzy thread. http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-a… http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraff… http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-pre… (Did I miss any good links?) Enjoy, --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

Re: [tor-talk] Guardian Tor article
by grarpamp 04 Oct '13

04 Oct '13

Some have said... > this [Snowden meta arena] has been a subject of discussion on > the [various] lists as well > Congrats, torproject :-D > "Tor Stinks" means you're doing it right; good job Tor devs :) > good news everybody; defense in depth is effective and practical! Yes, fine work all hands, everyone have a round at their favorite pub/equivalent tonight. > Of course, this is also from 2007. It's been a long time since then. Yet whether from 2007 or last week... when Monday rolls around, we must channel all this joy and get back to work. For the risks and attackers that we all face are real, motivated, well funded, and do not play fair by any set of rules. They do not stop and neither can we. Wins that do not result in elimination from the game are but temporary gains. We must always be better... train, practice, discipline, and enter ourselves into every race... leaving only a continuous cloud of dust behind for our adversaries to choke on. Till Monday, I got this round :)

1 0