latest false flag attack?

Mon Sep 10 15:46:03 PDT 2018

Johnny goy's email opens just fine here. And his tube.

Your 'tube link is wront, an "3D" is being inserted:
> https://www.youtube.com/watch?v=3DSPpXY1aWKgI

notice the 3D just after the = sign - get rid of that and you should
be good to go.

Here's the orig:
https://www.youtube.com/watch?v=SPpXY1aWKgI

On Mon, Sep 10, 2018 at 02:49:08PM -0700, Razer wrote:
> Screenshots of Youtube's message and the plaintext view in tbird.
> 
> In order:
> 
> https://78.media.tumblr.com/7daac9f305ff3f24dc6d82d8241c3e01/tumblr_pev0ea92gW1s925jyo2_1280.png
> 
> https://78.media.tumblr.com/35e57ce6c7ccdcc5a794368307b12754/tumblr_pev0ea92gW1s925jyo1_1280.png
> 
> 
> https://www.youtube.com/watch?v=3DSPpXY1aWKgI redirects to
> https://www.youtube.com/watch?v=3DSPpXY1aWK every time.
> 
> Rr
> 
> On 09/10/2018 02:05 PM, John Newman wrote:
> 
> Return-Path: <jnn at synfin.org>
> X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
> spoonbill.riseup.net
> X-Spam-Level:
> X-Spam-Pyzor: Reported 0 times.
> X-Spam-Status: No, score=0.7 required=5.0 tests=AM_TRUNCATED,BAYES_50,
>    
> CK_419SIZE,CK_KARD_SIZE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FORWARD_RELAY,
>     SPF_PASS shortcircuit=no autolearn=disabled version=3.4.1
> Delivered-To: g2s at riseup.net
> Received: from mx1.riseup.net (mx1-pn.riseup.net [10.0.1.33])
>     (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
>     (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation
> Secure Server CA" (verified OK))
>     by spoonbill.riseup.net (Postfix) with ESMTPS id F2586EF
>     for <g2s at riseup.net>; Mon, 10 Sep 2018 14:05:17 -0700 (PDT)
> Received: from wintermute.synfin.org (synfin.org [198.154.106.50])
>     by mx1.riseup.net (Postfix) with ESMTP id A1C8C1A14E9
>     for <g2s at riseup.net>; Mon, 10 Sep 2018 14:05:17 -0700 (PDT)
> Authentication-Results: mx1.riseup.net; dkim=pass
>     reason="1024-bit key; unprotected key/testing"
>     header.d=synfin.org header.i=@synfin.org header.b=jq44UGUQ;
>     dkim-adsp=pass; dkim-atps=neutral
> Received: from wintermute.synfin.org (localhost [127.0.0.1])
>     by wintermute.synfin.org (Postfix) with ESMTP id EBB703A2EF2;
>     Mon, 10 Sep 2018 17:05:10 -0400 (EDT)
> X-Virus-Scanned: amavisd-new at synfin.org
> Received: from wintermute.synfin.org ([127.0.0.1])
>     by wintermute.synfin.org (wintermute.synfin.org [127.0.0.1])
> (amavisd-new, port 10024)
>     with LMTP id ftxbQ2azdMA6; Mon, 10 Sep 2018 17:05:10 -0400 (EDT)
> Received: by wintermute.synfin.org (Postfix, from userid 1001)
>     id 49B9F3A2EEE; Mon, 10 Sep 2018 17:05:09 -0400 (EDT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synfin.org; s=SYNFIN;
>     t=1536613509; bh=z3ql+zv5aXsTdNvL6VQcq9aYHyrErCo/rp+HRAMOKiI=;
>     h=Date:From:To:Cc:Subject:References:In-Reply-To;
>     b=jq44UGUQ8751Uvpw4wxgZCB+mj9dEI7SYsIA76Jj+2eUvetOWcLC073FHx0tA9LND
>      ruKjyfP/i+0mrmBoUmS7slCFAGEuCPI4eWSPUl28SNywalgEC4G7edxqaPr+HTQ4kh
>      Ir0gu3BesKs5Qau4lmRmrJ+lXdJXmnRswHqazDHE=
> Date: Mon, 10 Sep 2018 17:05:09 -0400
> From: John Newman <jnn at synfin.org>
> To: Razer <g2s at riseup.net>
> Cc: cypherpunks at lists.cpunks.org
> Subject: Re: latest false flag attack?
> Message-ID: <20180910210509.caa4qio2imhfvkqb at synfin.org>
> References: <5b9301d3.1c69fb81.ec5a2.b89a at mx.google.com>
>  <dc83172a-89d2-abd6-ed1c-a55215d8bd30 at pilobilus.net>
>  <1e5a8098-d8fb-329c-dab1-1c68d5909432 at echeque.com>
>  <5b9590db.1c69fb81.a484b.1898 at mx.google.com>
>  <dafde8a6-bcdb-ffcf-8187-31e998864757 at riseup.net>
>  <b1706d7f-5855-af31-f0a2-0a718f061742 at pilobilus.net>
>  <2494c4ff-20b6-7f37-85f4-093d28705d30 at echeque.com>
>  <e836f7e0-2cc9-8569-e8e8-32d8707357b8 at pilobilus.net>
>  <20180910184229.jineyhssxbxfdql2 at synfin.org>
>  <c279992e-57ec-1c54-bfbd-0daa2b0e09e6 at riseup.net>
> MIME-Version: 1.0
> Content-Type: multipart/signed; micalg=pgp-sha256;
>     protocol="application/pgp-signature"; boundary="trm7cgddxkjxy4bi"
> Content-Disposition: inline
> In-Reply-To: <c279992e-57ec-1c54-bfbd-0daa2b0e09e6 at riseup.net>
> User-Agent: NeoMutt/20180716
> 
> 
> --trm7cgddxkjxy4bi
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
> 
> On Mon, Sep 10, 2018 at 01:11:00PM -0700, Razer wrote:
> >=20
> >=20
> > On 09/10/2018 11:42 AM, John Newman wrote:
> >=20
> > (In some fucking weird font that doesn't display at all in plaintext or
> > html in tbird, so, view source)
> 
> It's just plain text, generated by mutt. There is no fucking weird
> font. It has a content-type line of
> 
> "Content-Type: text/plain; charset=3Diso-8859-1
>  Content-Disposition: inline
>  Content-Transfer-Encoding: quoted-printable"
> 
> It looks fine in gmail, in a couple clients on my phone, in mutt, in the
> archives -
> 
> https://lists.cpunks.org/pipermail/cypherpunks/2018-September/043119.html
> 
> And the link works fine. It was=20
> 
> https://www.youtube.com/watch?v=3DSPpXY1aWKgI
> 
> It opens, I promise. Dunno why thunderbird is having issues. Period!  :)
> 
> --
> John
> 
> --trm7cgddxkjxy4bi
> Content-Type: application/pgp-signature; name="signature.asc"
> 
> -----BEGIN PGP SIGNATURE-----
> 
> iQEzBAEBCAAdFiEEF/1hWtINr+iz5MnS4yQgvtR6eMcFAluW3IEACgkQ4yQgvtR6
> eMdq2ggAu4yJ8Tnd68WwxocukVVBb1k1qqVowxWljOS7B4kVNO6E+MUVTDFzyOik
> +sYP7zilOKuPGvEwLdmTkjAAqrpSXtl5OObpnnijCMsvh3kC0ayNperA9tNIOT/H
> mjgB8U/DsM5MaK3/TbS/XdBsWWFRVBYil7SLzVoCSI0vlgGDJSI0hXWv02vyJKlq
> P56ofuE2toiJmc3d+ypOlPWYH5JWc0dcz9DbyNiF0o5zYzSuzH4D/DWCA3DJSY5Z
> XlBIx1IVYmR8S61b17P+M10EgYmR/nxNSBb+bOBhImM1NqttrwDE9CiQs5YKxBjk
> eaMfkHFmYPt0Yv8rJSFJtKhPG5SwTw==
> =zDAA
> -----END PGP SIGNATURE-----
> 
> --trm7cgddxkjxy4bi--
> 