From electromagnetize at gmail.com  Sun Dec  1 20:42:31 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 1 Dec 2013 22:42:31 -0600
Subject: audiovisual (urls)
Message-ID: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>

MIT's Peter Shor explains why he devised an algorithm for a quantum
computer that could unravel our online data encryption
http://www.newscientist.com/article/mg22029445.100-my-quantum-algorithm-wont-break-the-internet-yet.html


// not worth saying this may be relevant to landspeeder development...

'Electromagnon' effect couples electricity and magnetism in materials
http://phys.org/news/2013-11-electromagnon-effect-couples-electricity-magnetism.html

"It has been well known for a long time that electricity and magnetism
are two sides of the same coin. Waves in free space, such as visible
light or mobile phone radiation, always consist of both an electric
and a magnetic component. When it comes to material properties,
however, electricity and magnetism have been viewed as separate
topics."


To Settle Infinity Dispute, a New Law of Logic // not _really
https://www.simonsfoundation.org/quanta/20131126-to-settle-infinity-question-a-new-law-of-logic/

note: enormous problems with this. mathematics as if short-fiction.
what if concept/cosmology is being influenced by language framework
(q: is truth bounded or infinite).  hierarchical nesting core of set theory,
numberline in this context, why assumed 1d/2d versus N-dimensional.
issues of bounded infinity everywhere (particle ladder, consciousness),
perhaps zero is issue (empty set?) -- metaphysics seem completely off,
being and nothingess as set relations not grounded in reality it seems.
(note: why three zeroes allowed to diagram infinity as a first question,
what if number line is hiearchical, zero different dimension than 1...N)


Your Next Phone Will Be The Ultimate Surveillance Machine // via digg
http://www.buzzfeed.com/charliewarzel/your-next-phone-will-be-the-ultimate-surveillance-machine


The internet mystery that has the world baffled // via digg
http://www.telegraph.co.uk/news/worldnews/northamerica/usa/10468112/The-internet-mystery-that-has-the-world-baffled.html


// consider consolidating many credit cards into one card with bluetooth,
// how if that signal is hacked, access to eight cards combined the bounty...

Soon, You Might Pay for Everything With a Coin // via digg
http://blogs.smithsonianmag.com/ideas/2013/11/soon-you-might-pay-for-everything-with-a-coin-2/


[correlation between money and desire. what happens when truth is
separated from exchange, kept outside or removed from it. what is the
guarantee: in <blank> we trust?]

Watch The Idea, the First Animated Film to Deal with Big,
Philosophical Ideas (1932)
http://www.openculture.com/2013/11/the-idea-1932.html
http://www.youtube.com/watch?v=MplLxhyzWSg


Australia's Using Pop Radio to Track Space Junk
http://gizmodo.com/australias-using-pop-radio-to-track-space-junk-1474126810


[quote]  4 Great Tech Ideas That Flopped // via digg
http://www.scientificamerican.com/article.cfm?id=pogue-4-great-tech-ideas-that-flopped

"The plug-and-play gadget: A spinoff of the PalmPilot called The
Handspring Visor held much of the same attraction as the PhoneBloks.
It was a handheld organizer with a big cartridge slot on the back.
Into it you could snap a range of accessories: more storage, a
GPS receiver, a camera, a cellular transmitter, a remote control,
a Bluetooth module, an MP3 module or a voice recorder.

The Visors were on the market for about four years (1999 to 2003) and
have fans to this day. But clearly, the concept of interchangeable
gadget parts alone isn’t enough to start a revolution."

(note: the above article mentions something repeatedly endlessly about
PDA development, that it no longer exists, especially in the context
of the Handspring which preceded and was probably a trial for the
modularity of the iPhone and iPod Touch (a PDA or networked digital
assistant). the Handspring was certainly limited unlike the Apple
ecosystem approach which could expand exponentially and had wide
software integration, and thus the concept lives on in another product
line and its development yet is consistently not attributed this way.)

in-article url: Why Snap-Together Cell Phones Will Never Work
http://www.scientificamerican.com/article.cfm?id=why-snap-together-cell-phones-will-never-work

rel. [video] PhoneBLocks
http://www.youtube.com/watch?v=oDAw7vW7H0c


tuning of active exhaust systems (kaaaars)
http://www.theglobeandmail.com/globe-drive/car-tips/chamber-music-of-a-different-kind/article15589076/


[video] Siberian Ice Drummers
http://www.snowaddiction.org/2013/11/the-coolest-music-in-the-world-listen-to-siberian-ice-drummers-use-frozen-lake-baikal-as-an-incredible-musical-instrument.html


Hüsker Dü - Hare Krsna
http://www.youtube.com/watch?v=T3iXCEhHdUM

Hüsker Dü - Eight Miles High
http://www.youtube.com/watch?v=xBKyBlJ_JN8

Hüsker Dü - New Day Rising
http://www.youtube.com/watch?v=ND3haD-c0lw


--- ring as platform ---

emfs-cellphone/linear hall-effect sensor, gyro-mapping bt as datalogger
pole-mounted sensor+computer spatio-temp (freq) excavation/stratigraphy
2 axis or 3 axis, nfc/bt, archeo-GRID

SENSOR RINGS - ZigBee comms/authentication - potential

follow on box/device, monitor signal spacetime within map framework
TSCM monitoring of area (radiation, signals, frequencies, etc)
integrated in visual real-time data model


LED carpet turns the floor into a screen (with video)
http://www.newscientist.com/article/mg22029455.300-led-carpet-turns-the-floor-into-a-screen.html

(note: consider possibility of tempoary maze or labyrinth,
especially crypto or security applications, otherwise invisible)


[image]  ex. electromagnetic aesthetics as context
http://lostvhs.com/2013/11/17/point-blank/


How Braille Was Invented
http://gizmodo.com/how-braille-was-invented-1471756840
(invention, innovation, resistance, tragedy, victory)


Dead Kennedys - California Über Alles
http://www.youtube.com/watch?v=UW8UlY8eXCk

Kitsch Palace : Das Model
https://www.youtube.com/watch?v=J031_IrO24M


This New Polymer Regenerates Large Parts of Itself, Like Lizards Do
http://gizmodo.com/this-new-polymer-regenerates-large-parts-of-itself-lik-1472559143


Researchers discover roots of superfluorescent bursts from quantum wells
http://phys.org/news/2013-11-roots-superfluorescent-quantum-wells.html

[quote] ...mysteries remained, especially in results obtained at low
or zero magnetic fields. Kono said the team didn't understand at the
time why the wavelength of the burst changed over its 100-picosecond
span. Now they do.  //...

Kono said superfluorescence is a well-known many-body, or cooperative,
phenomenon in atomic physics. Many-body theory gives physicists a way
to understand how large numbers of interacting particles like
molecules, atoms and electrons behave collectively. Superfluorescence
is one example of how atoms under tight controls collaborate when
triggered by an external source of energy. //...

"The quantum well, as before, consisted of stacked blocks of an indium
gallium arsenide compound separated by barriers of gallium arsenide.
"It's a unique, solid-state environment where many-body effects
completely dominate the dynamics of the system," Kono said.

"When a strong magnetic field is applied, electrons and holes are
fully quantized – that is, constrained in their range of motion—just
like electrons in atoms," he said. "So the essential physics in the
presence of a high magnetic field is quite similar to that in atomic
gases. But as we decrease and eventually eliminate the magnetic field,
we're entering a regime atomic physics cannot access, where continua
of electronic states, or bands, exist." [unquote]


{educational fair-use of copyright, 2013}

 ∎ ♕ ♞




From coderman at gmail.com  Mon Dec  2 10:29:05 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 10:29:05 -0800
Subject: DEF CON cell network attacks
Message-ID: <CAJVRA1TgmboecsPAYecKuh3=Dgkw77wZ7V5PgENs1HvGCnt2Jg@mail.gmail.com>

On Sat, Nov 30, 2013 at 10:18 AM, Dan Staples <danstaples at disman.tl> wrote:
> I would be interested to see the details of the exploits you
> witnessed/were subject to (especially since I was at DC20).

of course; the complete details will be slow to arrive, not least
because detailed description requires a demonstration in a
reproduction test setup, rather than reporting of actual traffic. :/


that said, useful aspects i'll certainly provide on whim or request.



the defining characteristics of the two types of attacks:

DC19 with DRT:
- "high power on-site", less descriminant attacks. target by and
limited to location.
- MitM for system, application, and protocol level attacks. Evilgrade,
MasterKey vulns, etc.  mostly known and a few 0day escalated attacks.
- favorite attack: "Google Voice Search" always-on eavesdropper
payload; Speex voice from all audible participants.


DC20 with Alexander's toys:
- "in the towers", highly targeted to specific devices, active over
wide metro area.
- baseband exploit vector for device key retrieval, memory and storage
forensics, exfiltration.
- PDoS attacks (bricked secondary devices used as fall back once
identified by call graph; ~20 hours)
- favorite attack: baseband pwn in airplane mode, with ex-filtration
over custom channel.


DC21: no appearance (observed).  speculation ongoing...



> How exactly
> did you determine how the exploits occurred, and who was responsible for
> them?


reversing attacker capabilities, toolkits, TTPs, humanpower/hours, a
much longer tangent.  but this assertion is based on correlation of
the observed power, capacity, and protocols in specific bands
implemented by the attacker with the capabilities of the DRT system.
multiple locations, terabytes of captured spectrum, patience and
tuning...

as for who was operating it - unknown beyond the usual suspects, which
is a small set due to the restricted distribution of both the hardware
platform and the exploit kit atop it :)


---

i'll send more details once available.  the details and distribution
to be part of a separate FOIPA effort for US citizen security
enthusiasts that might be of interest to those following this thread.

best regards,




From coderman at gmail.com  Mon Dec  2 10:34:53 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 10:34:53 -0800
Subject: NSA: The Game
In-Reply-To: <E1VnPu2-0008T2-Tg@login01.fos.auckland.ac.nz>
References: <E1VnPu2-0008T2-Tg@login01.fos.auckland.ac.nz>
Message-ID: <CAJVRA1SB_OVg4je0w=TqscxjFU34qfy=2bWMV3QtG+t2uWX4+g@mail.gmail.com>

classic!  :P

and fun for the whole family this holiday season,


"""
Winning

The Internet users win if they kill all of the NSA agents.  The NSA agents win
if they render enough Internet users that the numbers of Internet users and
NSA agents are even.  In other words they win if the NSA agents constitute a
large enough voting bloc that they can't be lynched any more.  At that point
the NSA can unmask and openly subject the remaining Internet users to
extraordinary rendition.
"""




From coderman at gmail.com  Mon Dec  2 10:40:28 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 10:40:28 -0800
Subject: Jim Bell needs Bitcoins!
In-Reply-To: <529A0A5E.2080106@gogulski.com>
References: <1385370567.90180.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <5293740D.4030506@kjro.se>
 <1385417238.14632.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <CAFVRnyruheDLORaTjU=V6U3Z6m8XTjyzQYgA+psqWE=o1Y-k5g@mail.gmail.com>
 <1385421475.40988.YahooMailNeo@web141201.mail.bf1.yahoo.com>
 <CAFVRnyr1XVKf0f1KasBV_MBuH=P7+3XABQE2hur8M8BwZ-e6Pw@mail.gmail.com>
 <20131126003204.GK7523@hexapodia.org>
 <CABdoPv57xOUTRV+5DAO2R7MbYv7_u+mqEtV_JqBpuBrJW6kZJw@mail.gmail.com>
 <CAFVRnyrfvox-ZDpvWm5PThA3CSjSt55aB-7yp9bveEbbWB4JCA@mail.gmail.com>
 <20131126225653.F25A9F5F0@a-pb-sasl-quonix.pobox.com>
 <1385511819.20893.6.camel@anglachel>
 <CAHWD2rJBuQnna1tukXsN-NWZApm5d5hqAGAj6zO2d9MXXrzwjw@mail.gmail.com>
 <1385514403.20893.10.camel@anglachel>
 <CAHWD2rJxvzTVvm9QB0psOZop-iTDuR8T6qPyuMXKEpZHgLtx9g@mail.gmail.com>
 <1385578162.80373.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <CAHWD2r+9s1LL10PiAn1pOc5ZMhkFuh+nnM3xg17G6mzdjH4=dg@mail.gmail.com>
 <1385792924.64602.YahooMailNeo@web141202.mail.bf1.yahoo.com>
 <529A0A5E.2080106@gogulski.com>
Message-ID: <CAJVRA1QPFepYC1oamj9ggX3yuqrp7gcgGwXkLvtwK6aJD6VYbA@mail.gmail.com>

On Sat, Nov 30, 2013 at 7:55 AM, Mike Gogulski <mike at gogulski.com> wrote:
> Jim, install a wallet and send me an address. I'll send you some coin :)


and it should go without saying; don't use a third-party wallet service!

the bitcoin network is one of the most hostile networks in the world;
the trail of pwn is long and continuous.  wallet services, changes,
pools, casinos, just about every BTC denominated service is operating
at an elevated risk level traditionally seen in banking while running
their operations like a self hosted blog...




From moritz at headstrong.de  Mon Dec  2 14:14:01 2013
From: moritz at headstrong.de (Moritz)
Date: Mon, 02 Dec 2013 14:14:01 -0800
Subject: NSA: The Game
In-Reply-To: <E1VnPu2-0008T2-Tg@login01.fos.auckland.ac.nz>
References: <E1VnPu2-0008T2-Tg@login01.fos.auckland.ac.nz>
Message-ID: <529D0629.5070909@headstrong.de>

On 02.12.2013 01:34, Peter Gutmann wrote:
> NSA is a simple game

Everyone knows that Werewolf is for members of the Illuminati to find
each other, not a game.




From jamesdbell8 at yahoo.com  Mon Dec  2 17:01:29 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Mon, 2 Dec 2013 17:01:29 -0800 (PST)
Subject: Jim Bell needs Bitcoins!
In-Reply-To: <CAHWD2rJpwooCS+Z=FYArPPiwWspSpOd5HVX5WKfKD_eJT1UfAA@mail.gmail.com>
References: <1385370567.90180.YahooMailNeo@web141206.mail.bf1.yahoo.com>	<CAFVRnyruheDLORaTjU=V6U3Z6m8XTjyzQYgA+psqWE=o1Y-k5g@mail.gmail.com>	<1385421475.40988.YahooMailNeo@web141201.mail.bf1.yahoo.com>	<CAFVRnyr1XVKf0f1KasBV_MBuH=P7+3XABQE2hur8M8BwZ-e6Pw@mail.gmail.com>	<20131126003204.GK7523@hexapodia.org>	<CABdoPv57xOUTRV+5DAO2R7MbYv7_u+mqEtV_JqBpuBrJW6kZJw@mail.gmail.com>	<CAFVRnyrfvox-ZDpvWm5PThA3CSjSt55aB-7yp9bveEbbWB4JCA@mail.gmail.com>	<20131126225653.F25A9F5F0@a-pb-sasl-quonix.pobox.com>	<1385511819.20893.6.camel@anglachel>	<CAHWD2rJBuQnna1tukXsN-NWZApm5d5hqAGAj6zO2d9MXXrzwjw@mail.gmail.com>	<1385514403.20893.10.camel@anglachel>	<CAHWD2rJxvzTVvm9QB0psOZop-iTDuR8T6qPyuMXKEpZHgLtx9g@mail.gmail.com>	<1385578162.80373.YahooMailNeo@web141205.mail.bf1.yahoo.com>	<CAHWD2r+9s1LL10PiAn1pOc5ZMhkFuh+nnM3xg17G6mzdjH4=dg@mail.gmail.com>	<1385792924.64602.YahooMailNeo@web141202.mail.bf1.yahoo.com>	<529A0A5E.2080106@gogulski.com>	<20131203001729.38d2433f@Neptune>
 <CAHWD2rJpwooCS+Z=FYArPPiwWspSpOd5HVX5WKfKD_eJT1UfAA@mail.gmail.com>
Message-ID: <1386032489.9985.YahooMailNeo@web141206.mail.bf1.yahoo.com>

Because of the follow message(s), I feel the need to set the record straight.  For the record, I have no intention of putting any 'bets', 'donations', or 'predictions' into Sanjuro's (or anyone else's) 'Assassination Market'-type system!  First, as I think will be obvious, I am merely one of about 7.1 billion humans on Earth.  Any 'bets' I would make would be insignificant and therefore superfluous.  Secondly, right now I consider investing in my isotope-modified fiber-optic invention    http://www.freepatentsonline.com/WO2013101261A1.html   as being by far my highest priority.  (My primary need at this point is raising money to 'buy' about 100 national-stage patents from nations around the world.  There is no international patent system, at least other than Europe.  An invention must be patented in any nation where patent protection is desired.)  

Disclaimer:  I am not involved with Sanjuro's 'Assassination Market' in any way.  I do not know who he is.
          Jim Bell



________________________________
 From: Lodewijk andré de la porte <l at odewijk.nl>
To: Cathal Garvey <cathalgarvey at cathalgarvey.me> 
Cc: Jim Bell <jamesdbell8 at yahoo.com>; Mike Gogulski <mike at gogulski.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
Sent: Monday, December 2, 2013 4:36 PM
Subject: Re: Jim Bell needs Bitcoins!
 



On Dec 3, 2013 1:18 AM, "Cathal Garvey" <cathalgarvey at cathalgarvey.me> wrote:
>>
>> "Guy who publicly advocates spending anonymous currency to fund murder
>> needs anonymous currency!"
>
>> er, no.

>Doesn't mean he would do it or even like it. Damn square.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3402 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131202/43881762/attachment.txt>

From coderman at gmail.com  Mon Dec  2 17:56:47 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 17:56:47 -0800
Subject: peertech.org cert [was: DEF CON cell network attacks]
Message-ID: <CAJVRA1QyF4hf63=8ozozuKX86T=mrZ7iVY_GGSUjhQvMZgDrDA@mail.gmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

more details here soon...

only 443 should be considered valid - that is,
 try https://peertech.org first, plain-text must die.

and remember lkaglbgpvvcmc6xc.onion in case it becomes necessary

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:50:49:6a:55:85:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Arizona, L=Scottsdale,
O=GoDaddy.com, Inc.,
OU=http://certs.godaddy.com/repository/,
CN=Go Daddy Secure Certificate Authority - G2
        Validity
            Not Before: Dec  3 00:18:04 2013 GMT
            Not After : Dec  3 00:18:04 2014 GMT
        Subject: OU=Domain Control Validated, CN=peertech.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (4096 bit)
                Modulus (4096 bit):
                    00:b7:64:54:f1:2e:3a:ec:11:29:5a:93:1f:ad:f0:
                    16:8c:9c:eb:d9:0f:49:d2:9d:16:9a:53:a4:60:b6:
                    23:5b:4f:f3:17:90:77:0a:b3:25:27:f2:27:dd:65:
                    83:b6:e4:d5:13:b1:3b:97:5d:b5:b9:a9:62:32:4a:
                    7e:fb:67:73:20:5f:d7:44:52:c8:fc:ca:f8:fb:f1:
                    4f:d1:9d:94:39:72:12:2b:67:22:4c:0b:dc:7f:31:
                    34:cf:63:42:f1:c8:3d:ed:7c:de:2f:e2:63:e1:a2:
                    0a:c9:e6:86:dd:3f:39:73:af:01:58:d7:6d:59:7a:
                    51:d0:b7:bb:4c:8d:5f:1e:43:10:da:96:09:67:56:
                    2f:38:f6:a8:44:a7:96:9a:5c:bc:3e:6c:d6:d1:b6:
                    96:80:34:c8:88:84:4e:2e:06:14:0f:c5:f2:11:ff:
                    f6:15:06:f2:25:e7:d2:1a:8d:62:ef:5c:0e:fb:44:
                    8e:73:da:96:23:26:03:62:5c:2b:e6:70:5c:87:76:
                    d3:21:59:83:57:ac:56:15:bd:4f:25:fb:df:10:ec:
                    0e:56:fa:44:c8:8b:a4:97:ea:b1:98:71:3b:51:78:
                    79:ee:33:cf:b5:a5:68:15:86:9f:31:70:ee:8f:2f:
                    f4:53:32:b7:99:4f:67:21:db:1e:5d:4f:dc:5b:5d:
                    59:fd:30:3e:a2:04:22:13:76:05:4c:44:d6:08:fe:
                    b5:42:5f:b5:4a:38:4f:3d:eb:ea:59:63:ab:27:87:
                    7e:c4:46:3b:96:75:41:be:85:7e:e8:b5:8a:d4:11:
                    aa:cc:6a:28:b9:50:a3:f4:45:e2:50:d5:1f:6c:bf:
                    b8:ba:07:10:20:f8:7f:94:ec:15:d7:39:a6:fe:df:
                    65:78:1d:60:2c:b0:b1:76:40:82:b5:0f:d6:c8:e3:
                    8b:bb:f3:04:ff:80:e3:de:fc:2c:32:0e:21:13:d5:
                    bd:38:94:a1:c8:53:da:c7:3b:a9:a5:c1:70:ea:89:
                    ef:a7:f8:04:35:41:7e:38:05:73:ff:76:8a:c1:92:
                    7f:03:b8:76:48:b9:f6:61:b1:c5:22:be:b9:36:73:
                    de:0e:b8:36:4a:9c:c5:66:3b:63:2c:be:4f:20:75:
                    94:03:d8:05:d0:78:12:df:77:d8:17:51:7e:3c:24:
                    7f:cc:c6:8e:2a:f7:bc:f8:5c:29:64:bb:10:42:4d:
                    c0:83:64:6f:da:78:14:52:2e:97:49:e8:5d:7f:38:
                    36:3d:5a:5d:7c:44:71:28:21:04:6e:24:f5:f8:59:
                    93:1f:e9:d1:3e:6d:6d:db:93:57:8f:44:74:d6:64:
                    e9:2b:b6:33:fd:16:81:92:29:a5:80:6a:1f:2b:78:
                    66:d3:ed
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication,
                 TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 CRL Distribution Points:
                URI:http://crl.godaddy.com/gdig2s1-6.crl

            X509v3 Certificate Policies:
                Policy: 2.16.840.1.114413.1.7.23.1
                  CPS: http://certificates.godaddy.com/repository/

            Authority Information Access:
                OCSP - URI:http://ocsp.godaddy.com/
                CA Issuers -
                 URI:http://certificates.godaddy.com/repository/gdig2.crt

            X509v3 Authority Key Identifier:

keyid:40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE

            X509v3 Subject Alternative Name:
                DNS:peertech.org, DNS:www.peertech.org
            X509v3 Subject Key Identifier:
                C6:5E:C0:43:56:84:2E:11:A3:35:C8:AC:A9:70:96:7B:A5:2E:5B:77
    Signature Algorithm: sha256WithRSAEncryption
        b1:ea:a9:16:b6:9c:56:f4:59:99:df:36:69:92:a5:57:48:df:
        70:55:a6:1f:5b:51:74:b4:d1:d7:5a:f6:71:e6:92:f2:56:14:
        07:f4:2c:14:06:50:4a:e6:f8:32:8c:a1:ed:4b:25:50:fa:05:
        99:01:74:db:45:ae:c2:ca:dc:f3:e7:ad:50:1b:12:c2:1e:ea:
        c8:19:41:db:b0:eb:f1:0c:c7:ba:af:c2:08:9e:7d:3c:c9:de:
        5d:7f:ff:9e:c3:cc:54:bd:ac:1f:24:47:17:ae:ba:75:b7:0b:
        b7:ee:3b:3a:ba:2a:f7:19:19:1a:98:56:35:34:16:8a:ec:ac:
        50:f0:45:7c:06:5a:fe:b1:d8:8b:13:94:5b:2c:1c:3d:b6:df:
        f9:79:69:b0:75:68:b3:e5:01:8e:90:85:bc:bf:92:47:ba:d0:
        9c:8c:5d:28:d6:d3:17:58:96:76:ed:bf:65:75:7c:25:58:57:
        2f:52:ae:9f:a9:a1:35:92:ca:28:13:b6:ae:a8:89:cf:ce:a6:
        cd:31:28:42:f7:66:9d:de:38:0d:4c:d5:ae:49:6c:db:92:28:
        a2:7c:4a:18:8e:7b:b6:0a:c9:d4:8d:0a:82:d4:04:a6:d0:3d:
        8c:a6:37:ac:16:98:bd:79:49:83:60:7f:b5:dc:d7:80:aa:5d:
        ae:f7:11:eb
- -----BEGIN CERTIFICATE-----
MIIGJTCCBQ2gAwIBAgIHK1BJalWFVTANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UE
BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY
BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMu
Z29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3Vy
ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xMzEyMDMwMDE4MDRaFw0x
NDEyMDMwMDE4MDRaMDoxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl
ZDEVMBMGA1UEAxMMcGVlcnRlY2gub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEAt2RU8S467BEpWpMfrfAWjJzr2Q9J0p0WmlOkYLYjW0/zF5B3CrMl
J/In3WWDtuTVE7E7l121ualiMkp++2dzIF/XRFLI/Mr4+/FP0Z2UOXISK2ciTAvc
fzE0z2NC8cg97XzeL+Jj4aIKyeaG3T85c68BWNdtWXpR0Le7TI1fHkMQ2pYJZ1Yv
OPaoRKeWmly8PmzW0baWgDTIiIROLgYUD8XyEf/2FQbyJefSGo1i71wO+0SOc9qW
IyYDYlwr5nBch3bTIVmDV6xWFb1PJfvfEOwOVvpEyIukl+qxmHE7UXh57jPPtaVo
FYafMXDujy/0UzK3mU9nIdseXU/cW11Z/TA+ogQiE3YFTETWCP61Ql+1SjhPPevq
WWOrJ4d+xEY7lnVBvoV+6LWK1BGqzGoouVCj9EXiUNUfbL+4ugcQIPh/lOwV1zmm
/t9leB1gLLCxdkCCtQ/WyOOLu/ME/4Dj3vwsMg4hE9W9OJShyFPaxzuppcFw6onv
p/gENUF+OAVz/3aKwZJ/A7h2SLn2YbHFIr65NnPeDrg2SpzFZjtjLL5PIHWUA9gF
0HgS33fYF1F+PCR/zMaOKve8+FwpZLsQQk3Ag2Rv2ngUUi6XSehdfzg2PVpdfERx
KCEEbiT1+FmTH+nRPm1t25NXj0R01mTpK7Yz/RaBkimlgGofK3hm0+0CAwEAAaOC
AbMwggGvMA8GA1UdEwEB/wQFMAMBAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMA4GA1UdDwEB/wQEAwIFoDA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8v
Y3JsLmdvZGFkZHkuY29tL2dkaWcyczEtNi5jcmwwUwYDVR0gBEwwSjBIBgtghkgB
hv1tAQcXATA5MDcGCCsGAQUFBwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFk
ZHkuY29tL3JlcG9zaXRvcnkvMHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYY
aHR0cDovL29jc3AuZ29kYWRkeS5jb20vMEAGCCsGAQUFBzAChjRodHRwOi8vY2Vy
dGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvZ2RpZzIuY3J0MB8GA1Ud
IwQYMBaAFEDCvSeOzDSDMKIz1/tss/C0LIDOMCkGA1UdEQQiMCCCDHBlZXJ0ZWNo
Lm9yZ4IQd3d3LnBlZXJ0ZWNoLm9yZzAdBgNVHQ4EFgQUxl7AQ1aELhGjNcisqXCW
e6UuW3cwDQYJKoZIhvcNAQELBQADggEBALHqqRa2nFb0WZnfNmmSpVdI33BVph9b
UXS00dda9nHmkvJWFAf0LBQGUErm+DKMoe1LJVD6BZkBdNtFrsLK3PPnrVAbEsIe
6sgZQduw6/EMx7qvwgiefTzJ3l1//57DzFS9rB8kRxeuunW3C7fuOzq6KvcZGRqY
VjU0ForsrFDwRXwGWv6x2IsTlFssHD223/l5abB1aLPlAY6Qhby/kke60JyMXSjW
0xdYlnbtv2V1fCVYVy9Srp+poTWSyigTtq6oic/Ops0xKEL3Zp3eOA1M1a5JbNuS
KKJ8ShiOe7YKydSNCoLUBKbQPYymN6wWmL15SYNgf7Xc14CqXa73Ees=
- -----END CERTIFICATE-----


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iL4EAREKAGYFAlKdOgZfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldDQxQzEyQjhDMzA3RDdFMjE5OEFBNTc4MTY1
QTg0N0U3QzJCOTM4MEMACgkQZahH58K5OAxRPgD/QkjoUgAe+zqlkKKRNEhRICYp
XQADFHeMuIqEF2D6+00BAJF/sZ7od2vyaL85tSJGMjPGi4CvwhJXBGeedxlWPufI
=O2TU
-----END PGP SIGNATURE-----




From coderman at gmail.com  Mon Dec  2 18:00:04 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 18:00:04 -0800
Subject: peertech.org cert [was: DEF CON cell network attacks]
In-Reply-To: <CAJVRA1QyF4hf63=8ozozuKX86T=mrZ7iVY_GGSUjhQvMZgDrDA@mail.gmail.com>
References: <CAJVRA1QyF4hf63=8ozozuKX86T=mrZ7iVY_GGSUjhQvMZgDrDA@mail.gmail.com>
Message-ID: <CAJVRA1TkjuAu59Nyg+4NyVU1vstPGe9c6ipomnGmvQSCOke0RA@mail.gmail.com>

On Mon, Dec 2, 2013 at 5:56 PM, coderman <coderman at gmail.com> wrote:
> -----BEGIN MANGLING ...


let's try attachment clients won't mangle... (previous will give bad sig)
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

more details here soon...

only 443 should be considered valid - that is,
 try https://peertech.org first, plain-text must die.

and remember lkaglbgpvvcmc6xc.onion in case it becomes necessary

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:50:49:6a:55:85:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Arizona, L=Scottsdale,
	 O=GoDaddy.com, Inc.,
	 OU=http://certs.godaddy.com/repository/,
	 CN=Go Daddy Secure Certificate Authority - G2
        Validity
            Not Before: Dec  3 00:18:04 2013 GMT
            Not After : Dec  3 00:18:04 2014 GMT
        Subject: OU=Domain Control Validated, CN=peertech.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (4096 bit)
                Modulus (4096 bit):
                    00:b7:64:54:f1:2e:3a:ec:11:29:5a:93:1f:ad:f0:
                    16:8c:9c:eb:d9:0f:49:d2:9d:16:9a:53:a4:60:b6:
                    23:5b:4f:f3:17:90:77:0a:b3:25:27:f2:27:dd:65:
                    83:b6:e4:d5:13:b1:3b:97:5d:b5:b9:a9:62:32:4a:
                    7e:fb:67:73:20:5f:d7:44:52:c8:fc:ca:f8:fb:f1:
                    4f:d1:9d:94:39:72:12:2b:67:22:4c:0b:dc:7f:31:
                    34:cf:63:42:f1:c8:3d:ed:7c:de:2f:e2:63:e1:a2:
                    0a:c9:e6:86:dd:3f:39:73:af:01:58:d7:6d:59:7a:
                    51:d0:b7:bb:4c:8d:5f:1e:43:10:da:96:09:67:56:
                    2f:38:f6:a8:44:a7:96:9a:5c:bc:3e:6c:d6:d1:b6:
                    96:80:34:c8:88:84:4e:2e:06:14:0f:c5:f2:11:ff:
                    f6:15:06:f2:25:e7:d2:1a:8d:62:ef:5c:0e:fb:44:
                    8e:73:da:96:23:26:03:62:5c:2b:e6:70:5c:87:76:
                    d3:21:59:83:57:ac:56:15:bd:4f:25:fb:df:10:ec:
                    0e:56:fa:44:c8:8b:a4:97:ea:b1:98:71:3b:51:78:
                    79:ee:33:cf:b5:a5:68:15:86:9f:31:70:ee:8f:2f:
                    f4:53:32:b7:99:4f:67:21:db:1e:5d:4f:dc:5b:5d:
                    59:fd:30:3e:a2:04:22:13:76:05:4c:44:d6:08:fe:
                    b5:42:5f:b5:4a:38:4f:3d:eb:ea:59:63:ab:27:87:
                    7e:c4:46:3b:96:75:41:be:85:7e:e8:b5:8a:d4:11:
                    aa:cc:6a:28:b9:50:a3:f4:45:e2:50:d5:1f:6c:bf:
                    b8:ba:07:10:20:f8:7f:94:ec:15:d7:39:a6:fe:df:
                    65:78:1d:60:2c:b0:b1:76:40:82:b5:0f:d6:c8:e3:
                    8b:bb:f3:04:ff:80:e3:de:fc:2c:32:0e:21:13:d5:
                    bd:38:94:a1:c8:53:da:c7:3b:a9:a5:c1:70:ea:89:
                    ef:a7:f8:04:35:41:7e:38:05:73:ff:76:8a:c1:92:
                    7f:03:b8:76:48:b9:f6:61:b1:c5:22:be:b9:36:73:
                    de:0e:b8:36:4a:9c:c5:66:3b:63:2c:be:4f:20:75:
                    94:03:d8:05:d0:78:12:df:77:d8:17:51:7e:3c:24:
                    7f:cc:c6:8e:2a:f7:bc:f8:5c:29:64:bb:10:42:4d:
                    c0:83:64:6f:da:78:14:52:2e:97:49:e8:5d:7f:38:
                    36:3d:5a:5d:7c:44:71:28:21:04:6e:24:f5:f8:59:
                    93:1f:e9:d1:3e:6d:6d:db:93:57:8f:44:74:d6:64:
                    e9:2b:b6:33:fd:16:81:92:29:a5:80:6a:1f:2b:78:
                    66:d3:ed
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication,
                 TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 CRL Distribution Points: 
                URI:http://crl.godaddy.com/gdig2s1-6.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.114413.1.7.23.1
                  CPS: http://certificates.godaddy.com/repository/

            Authority Information Access: 
                OCSP - URI:http://ocsp.godaddy.com/
                CA Issuers - 
                 URI:http://certificates.godaddy.com/repository/gdig2.crt

            X509v3 Authority Key Identifier: 
                keyid:40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE

            X509v3 Subject Alternative Name: 
                DNS:peertech.org, DNS:www.peertech.org
            X509v3 Subject Key Identifier: 
                C6:5E:C0:43:56:84:2E:11:A3:35:C8:AC:A9:70:96:7B:A5:2E:5B:77
    Signature Algorithm: sha256WithRSAEncryption
        b1:ea:a9:16:b6:9c:56:f4:59:99:df:36:69:92:a5:57:48:df:
        70:55:a6:1f:5b:51:74:b4:d1:d7:5a:f6:71:e6:92:f2:56:14:
        07:f4:2c:14:06:50:4a:e6:f8:32:8c:a1:ed:4b:25:50:fa:05:
        99:01:74:db:45:ae:c2:ca:dc:f3:e7:ad:50:1b:12:c2:1e:ea:
        c8:19:41:db:b0:eb:f1:0c:c7:ba:af:c2:08:9e:7d:3c:c9:de:
        5d:7f:ff:9e:c3:cc:54:bd:ac:1f:24:47:17:ae:ba:75:b7:0b:
        b7:ee:3b:3a:ba:2a:f7:19:19:1a:98:56:35:34:16:8a:ec:ac:
        50:f0:45:7c:06:5a:fe:b1:d8:8b:13:94:5b:2c:1c:3d:b6:df:
        f9:79:69:b0:75:68:b3:e5:01:8e:90:85:bc:bf:92:47:ba:d0:
        9c:8c:5d:28:d6:d3:17:58:96:76:ed:bf:65:75:7c:25:58:57:
        2f:52:ae:9f:a9:a1:35:92:ca:28:13:b6:ae:a8:89:cf:ce:a6:
        cd:31:28:42:f7:66:9d:de:38:0d:4c:d5:ae:49:6c:db:92:28:
        a2:7c:4a:18:8e:7b:b6:0a:c9:d4:8d:0a:82:d4:04:a6:d0:3d:
        8c:a6:37:ac:16:98:bd:79:49:83:60:7f:b5:dc:d7:80:aa:5d:
        ae:f7:11:eb
- -----BEGIN CERTIFICATE-----
MIIGJTCCBQ2gAwIBAgIHK1BJalWFVTANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UE
BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY
BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMu
Z29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3Vy
ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xMzEyMDMwMDE4MDRaFw0x
NDEyMDMwMDE4MDRaMDoxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl
ZDEVMBMGA1UEAxMMcGVlcnRlY2gub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEAt2RU8S467BEpWpMfrfAWjJzr2Q9J0p0WmlOkYLYjW0/zF5B3CrMl
J/In3WWDtuTVE7E7l121ualiMkp++2dzIF/XRFLI/Mr4+/FP0Z2UOXISK2ciTAvc
fzE0z2NC8cg97XzeL+Jj4aIKyeaG3T85c68BWNdtWXpR0Le7TI1fHkMQ2pYJZ1Yv
OPaoRKeWmly8PmzW0baWgDTIiIROLgYUD8XyEf/2FQbyJefSGo1i71wO+0SOc9qW
IyYDYlwr5nBch3bTIVmDV6xWFb1PJfvfEOwOVvpEyIukl+qxmHE7UXh57jPPtaVo
FYafMXDujy/0UzK3mU9nIdseXU/cW11Z/TA+ogQiE3YFTETWCP61Ql+1SjhPPevq
WWOrJ4d+xEY7lnVBvoV+6LWK1BGqzGoouVCj9EXiUNUfbL+4ugcQIPh/lOwV1zmm
/t9leB1gLLCxdkCCtQ/WyOOLu/ME/4Dj3vwsMg4hE9W9OJShyFPaxzuppcFw6onv
p/gENUF+OAVz/3aKwZJ/A7h2SLn2YbHFIr65NnPeDrg2SpzFZjtjLL5PIHWUA9gF
0HgS33fYF1F+PCR/zMaOKve8+FwpZLsQQk3Ag2Rv2ngUUi6XSehdfzg2PVpdfERx
KCEEbiT1+FmTH+nRPm1t25NXj0R01mTpK7Yz/RaBkimlgGofK3hm0+0CAwEAAaOC
AbMwggGvMA8GA1UdEwEB/wQFMAMBAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMA4GA1UdDwEB/wQEAwIFoDA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8v
Y3JsLmdvZGFkZHkuY29tL2dkaWcyczEtNi5jcmwwUwYDVR0gBEwwSjBIBgtghkgB
hv1tAQcXATA5MDcGCCsGAQUFBwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFk
ZHkuY29tL3JlcG9zaXRvcnkvMHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYY
aHR0cDovL29jc3AuZ29kYWRkeS5jb20vMEAGCCsGAQUFBzAChjRodHRwOi8vY2Vy
dGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvZ2RpZzIuY3J0MB8GA1Ud
IwQYMBaAFEDCvSeOzDSDMKIz1/tss/C0LIDOMCkGA1UdEQQiMCCCDHBlZXJ0ZWNo
Lm9yZ4IQd3d3LnBlZXJ0ZWNoLm9yZzAdBgNVHQ4EFgQUxl7AQ1aELhGjNcisqXCW
e6UuW3cwDQYJKoZIhvcNAQELBQADggEBALHqqRa2nFb0WZnfNmmSpVdI33BVph9b
UXS00dda9nHmkvJWFAf0LBQGUErm+DKMoe1LJVD6BZkBdNtFrsLK3PPnrVAbEsIe
6sgZQduw6/EMx7qvwgiefTzJ3l1//57DzFS9rB8kRxeuunW3C7fuOzq6KvcZGRqY
VjU0ForsrFDwRXwGWv6x2IsTlFssHD223/l5abB1aLPlAY6Qhby/kke60JyMXSjW
0xdYlnbtv2V1fCVYVy9Srp+poTWSyigTtq6oic/Ops0xKEL3Zp3eOA1M1a5JbNuS
KKJ8ShiOe7YKydSNCoLUBKbQPYymN6wWmL15SYNgf7Xc14CqXa73Ees=
- -----END CERTIFICATE-----


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iL4EAREKAGYFAlKdOgZfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldDQxQzEyQjhDMzA3RDdFMjE5OEFBNTc4MTY1
QTg0N0U3QzJCOTM4MEMACgkQZahH58K5OAxRPgD/QkjoUgAe+zqlkKKRNEhRICYp
XQADFHeMuIqEF2D6+00BAJF/sZ7od2vyaL85tSJGMjPGi4CvwhJXBGeedxlWPufI
=O2TU
-----END PGP SIGNATURE-----

From jamesdbell8 at yahoo.com  Mon Dec  2 19:28:06 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Mon, 2 Dec 2013 19:28:06 -0800 (PST)
Subject: audiovisual (urls)
In-Reply-To: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>
References: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>
Message-ID: <1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com>

From: brian carroll <electromagnetize at gmail.com>

To: cypherpunks at cpunks.org 
Sent: Sunday, December 1, 2013 8:42 PM
Subject: audiovisual (urls)
 

>MIT's Peter Shor explains why he devised an algorithm for a quantum
>computer that could unravel our online data encryption
>http://www.newscientist.com/article/mg22029445.100-my-quantum-algorithm-wont-break-the-internet-yet.html

From that article:

     Quantum cryptography can't be broken by factorisation. Could it one day replace standard cryptosystems?
For
 short distances it wouldn't be too hard to build a quantum key 
distribution network to encrypt data. Over longer distances, you would 
need quantum repeaters every 50 kilometres or so on the fibre-optic 
network, as it's difficult to maintain a quantum state over long 
distances. Even if they are cheap by then, it's a lot of investment.
=====end of quote=====

My fiber optic invention has a certain relevance here. A typical modern germania-doped-core (GeO2) silica optical fiber has a loss of about 0.19 decibels/kilometer (db/km).  Over 50 km, the loss is (50 km x 0.19 db/km) = 9.5 db, ignoring splice losses.  (A good splice has a loss of about 0.10 db.)  So, the quote above is indicating that above a loss of about 10 db, a quantum system is hard to maintain.  I have suggested in my patent application that isotope-modified fiber (where the Si-29 level is brought from nature's 4.67% (atom/atom) to 0.10 %, the loss might decrease by a factor of 10 to 20.  This means that the ultimate distance limit might increase to 50 x 10 = 500 km, to 50 x 20 = 1000 km.  That would be a major improvement if it works.
The reason that this new fiber would be necessary is this:  Ever since the invention of the EDFA (Erbium-doped fiber amplifier  http://en.wikipedia.org/wiki/Optical_amplifier  ) in 1986, it has been used to amplify IR signals in the 1510-1560 nanometer band.  Using it and ordinary signals (not quantum signals) it is possible to go about 125 kilometers between amplifiers.  (In other words, that usage tolerates about 25 db of optical loss before an EDFA is necessary.)  However, apparently an EDFA cannot be used to amplify a quantum system.  http://www.nict.go.jp/en/press/2010/02/08-1.html     Or, at least, not directly.

      Jim Bell 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3862 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131202/7c2f3e7b/attachment.txt>

From pokokohua at gmail.com  Mon Dec  2 11:29:31 2013
From: pokokohua at gmail.com (Pokokohua)
Date: Mon, 2 Dec 2013 19:29:31 +0000
Subject: NSA: The Game
Message-ID: <CAABhiFw_+WoVMdoB=eUnL8gZb62NsO0D8B_Vv5kXM0VuyAmo6A@mail.gmail.com>

Would it work swapping renditions for drone strikes as an option?

> For those of you familiar with the game Werewolf (also known as Mafia),
> here's an updated version, NSA.

> Peter.




From coderman at gmail.com  Mon Dec  2 21:31:52 2013
From: coderman at gmail.com (coderman)
Date: Mon, 2 Dec 2013 21:31:52 -0800
Subject: trends in cybersecurity
In-Reply-To: <20131203041120.82D5A2280BA@palinka.tinho.net>
References: <20131203041120.82D5A2280BA@palinka.tinho.net>
Message-ID: <CAJVRA1RQ4vA0h4DK9sOWqLyF=iS12B2iBsYWs8hg9ApnuLH3mw@mail.gmail.com>

On Mon, Dec 2, 2013 at 8:11 PM,  <dan at geer.org> wrote:
>...
> Trends in Cyber Security
> http://geer.tinho.net/geer.nro.6xi13.txt

thought provoking read, as always. thanks Dan :)

this is worth posting whole, particularly this observation:
"""
... polarization has come to cyber
security.  High end practice is accelerating away from the low end.
The best skills are now astonishingly good while the great mass of
those dependent on cyber security are ever less able to even estimate
what it is that they do not know, much less act on it.  This
polarization is driven by the fundamental strategic asymmetry of
cyber security, namely that while the workfactor for the offender
is the incremental price of finding a new method of attack, the
workfactor for the defender is the cumulative cost of forever
defending against all attack methods yet discovered.  Over time,
the curve for the cost of finding a new attack and the curve for
the cost of defending against all attacks to date must cross.  Once
those curves cross, the offender never has to worry about being out
of the money.  That crossing event occurred some time ago.
"""


i do have one comment, per:

"""
Everyone my age working in cyber security was trained for something
else, and because of that switch between one field and another
brings along the hybrid vigor of seeing the cyber security world
through a different lens.
"""

instead of having a "cyber security" profession, all aspects of
"information security", "software security", or "cyber security" as a
specialization should not exist.  competence and experience with these
subjects should be considered part of routine software and systems
development practice. (right now this is mostly impractical, however,
it need not always be so...)


best regards,



--- cut-for-posterity ---


.Trends in Cyber Security
.Dan Geer, 6 November 13, NRO

Thank you for the invitation to speak with you today, which, let
me be clear, is me speaking as myself and not for anybody or anything
else.  As you know, I work the cyber security trade, that is to say
that my occupation is cyber security.  Note that I said "occupation"
rather than "profession."  On 18 September, the U.S. National Academy
of Sciences, on behalf of the Department of Homeland Security,
concluded that cyber security should be seen as an occupation and
not a profession because the rate of change is too great to consider
professionalization.[1]  You may well agree that that rate of change
is paramount and thus why cyber security is the most intellectually
demanding occupation on the planet.  In writing this essay, I will
keep my comments to trends rather than point estimates, just as you
asked in your invitation, but let me emphasize the wisdom of your
request by noting that the faster the rate of change, the more it
is trends that matter and not the value of any given variable at
any given time.  With luck, each of these trends will not be something
that you would argue with as a trend.  Argument, if any, will be
in their interpretation.

Note also that these trends do not constitute a set of mutually
exclusive, collectively exhaustive characterizations of the space
in which we live and work.  Some of them are correlated with others.
Some of them are newly emergent, some not.  Some of them are
reversible to a degree; some not reversible at all.  I am not, today
anyway, looking for causality.

Trend #1: Polarization

Much has been written about the increasing polarization of American
life.[2]  The middle is getting smaller whether we are noting that
only the middle class is shrinking, that it is the middle of the
country that is depopulating, that the political middle is lonelier
and lonelier, that both farms and banks are now only too small to
matter or too big to fail, that almost all journalism is now advocacy
journalism, that middle tier college education is a ticket to debt
and nothing else.

I submit that this trend towards polarization has come to cyber
security.  High end practice is accelerating away from the low end.
The best skills are now astonishingly good while the great mass of
those dependent on cyber security are ever less able to even estimate
what it is that they do not know, much less act on it.  This
polarization is driven by the fundamental strategic asymmetry of
cyber security, namely that while the workfactor for the offender
is the incremental price of finding a new method of attack, the
workfactor for the defender is the cumulative cost of forever
defending against all attack methods yet discovered.  Over time,
the curve for the cost of finding a new attack and the curve for
the cost of defending against all attacks to date must cross.  Once
those curves cross, the offender never has to worry about being out
of the money.  That crossing event occurred some time ago.

I'll come back to this first bullet at the end, but I mention it
first as polarization is becoming structural and of all the trends
the most telling.  You can confirm this by asking the best cyber
security people what they do on the Internet and what they won't
do on the Internet.  You will find it sharply different than what
the public at large does or will do.  The best people know the most,
and they are withdrawing, they are rejecting technologies.  To use
the words and style of the Intelligence Community, they are
compartmentalizing.

Trend #2: Trends themselves

The idea that under the pressure of constant change about all you
can measure is the slope of the curve has gone from
don't-bother-me-with-math to everybody's-doing-it.  A Google search
for the phrase "information security trends" turns up 13,400 hits
and no two of the top ten are from the same source.  Consultancies
talk about what they are seeing in the back room, product vendors
talk about evolving needs, and reporters talk about what they are
seeing out on the street.

I am one of those folks.  A Wall Street colleague and I run the
Index of Cyber Security.[3]  The ICS is what is called a sentiment-based
index; if you are familiar with the US Consumer Confidence Index,[4]
then you already know what a sentiment-based index is.  Respondents
to the ICS are top drawer cyber security practitioners with direct
operational responsibility who share, each month, how their view
of security in several areas has changed since the month before.
Because there are no absolutes in cyber security, not even widely
agreed upon definitions of the core terms that make up cyber security
practice, a sentiment-based Index is, in fact, the best decision
support that can be done.

The Index asks the respondents monthly whether each of two dozen
different risks has gotten better, gotten worse, gotten a lot better,
gotten a lot worse, or stayed the same since the month before.  Out
of this, the Index of Cyber Security is calculated and released at
6pm on the last calendar day of the month, in further similarity
to the Consumer Confidence Index.  We write an analytic annual
report that I have given to the organizers for your further reading.
As an index of risk, a higher ICS number means higher risk.  That
risk number has risen, and seems likely to continue to rise.  It
is a composite trend line, but what is more interesting is that the
components of the risk are much more varied, i.e., what is the
dominating risk one month may not be the next.  We think that this
captures, in part, the dynamic nature of cyber security and does
so in a way not otherwise being done.  Respondents seem to agree
that the ICS does offer decision support to front-line people such
as themselves.

Trend #2, then, is that there is increasingly wide acceptance that
absolute measures are not worth seeking and a kind of confirmation
that cyber security is a practice, not a device.

Trend #3: Physics and its impact on data

As you well know, more and more data is collected and more and more
of that data is in play.  The general, round-numbers dynamic of
this trend are these: Moore's Law continues to give us two orders
of magnitude in compute power per dollar per decade while storage
grows at three orders of magnitude and bandwidth at four.  These
are top-down economic drivers and they relentlessly warp what is
the economically optimum computing model.  The trend is clear; the
future is increasingly dense with stored data but, paradoxically,
despite the massive growth of data volume, that data becomes more
mobile with time.

As is obvious, this bears on cyber security as data is what cyber
security is all about.  In 2007, Jim Gray gave a seminal talk[5]
about the transformation of science, coining the term "fourth
paradigm."  By that he meant that the history of science is that
science began as an endeavor organized around empirical observation.
After that came the age of theory -- theorizing as the paradigm of
what science did.  Then science became computational, again meaning
that the paradigm of what science did was to calculate.  His argument
for a fourth era was that of a paradigm shift from computational
science to data intensive science.  You here at NRO need no primer
on the power of that shift in paradigm, but I am here to tell you
that cyber security is embracing that fourth paradigm and it is
doing it now.

Ecology professor Philip Greear would challenge his graduate students
to catalog all the life in a cubic yard of forest floor.  Computer
science professor Donald Knuth would challenge his graduate students
to catalog everything their computers had done in the last ten
seconds.  It is hard to say which is more difficult, but everywhere
you look, cyber security practitioners are trying to get a handle
on "What is normal?" so that that which is abnormal can be identified
early in the game.  Behavioral approaches leading towards intrusion
detection are exactly the search for anomaly, and they are data
based.  The now-famous attack on RSA Data Security that led to RSA
buying Net Witness is an example of wanting to know everything so
as to recognize something.  I'm on the record at book length [6]
that the central organizing principle behind a competent security
program is to instrument your data sufficiently well that nothing
moves without it being noticed.  Physics has made it possible to
put computers everywhere.  Physics has made it possible to fill
them all with data.

Cyber security is barely keeping up, and not just because of two,
three, or four orders of magnitude in the physics upstream of the
marketplace.

Trend #4: Need for prediction

We all know that knowledge is power.  We all know that there is a
subtle yet important distinction between information and knowledge.
We all know that a negative declaration like "X did not happen" can
be only proven if you have the enumeration of *everything* that did
happen and can show that X is not in it.  We all know that a stitch
in time saves nine, but only if we know where to put the stitch.
We all know that without security metrics, the outcome is either
overspending or under protecting.

The more technologic the society becomes, the greater the dynamic
range of possible failures.  When you live in a cave, starvation,
predators, disease, and lightning are about the full range of
failures that end life as you know it and you are well familiar
with all of them.  When you live in a technologic society where
everybody and everything is optimized in some way akin to just-in-time
delivery, the dynamic range of failures is incomprehensibly larger
and largely incomprehensible.  The wider the dynamic range of
failure, the more prevention is the watchword.  As technologic
society grows more interdependent within itself, the more it must
rely on prediction based on data collected in broad ways, not
targeted ways.

Some define risk as the probability of a failure times the cost of
that failure.  To be clear, a trend in favor of making predictions
is a trend subsidiary to a trend in the cost of failure.  I've
written at length elsewhere about how an increasing downside cost
of failure requires that we find ways to be resilient, but not
resilient in the sense of rich redundancy, not resilient in the
sense of having quick recovery mechanisms, but resilient in the
sense of having alternate primary means that do not share common
mode risks.  As such, I strongly recommend that manual means be
preserved wherever possible because whatever those manual means
are, they are already fully capitalized and they do not share common
mode risk with digital means.

There is now more information security risk sloshing around the
economy than could actually be accepted were it exposed.  The
tournament now turns to who can minimize their risk the best, which,
in the civilian economy at large, means who can most completely
externalize their downside information security costs.  The weapons
here are perhaps as simple as the wisdom of Delphi, "Know thyself"
and "Nothing to excess" -- know thyself in the sense of quantitative
rigor and a perpetual propensity to design information systems with
failure in mind; nothing to excess in the sense of mimicking the
biologic world's proof by demonstration that species diversity is
the greatest bulwark against loss of an ecosystem.

Trend #5: Abandonment

If I abandon a car on the street, then eventually someone will be
able to claim title.  If I abandon a bank account, then the State
will eventually seize it.  If I abandon real estate by failing to
remedy a trespass, then in the fullness of time adverse possession
takes over.  If I don't use my trademark, then my rights go over
to those who use what was and could have remained mine.  If I abandon
my spouse and/or children, then everyone is taxed to remedy my
actions.  If I abandon a patent application, then after a date
certain the teaching that it proposes passes over to the rest of
you.  If I abandon my hold on the confidentiality of data such as
by publishing it, then that data passes over to the commonweal not
to return.  If I abandon my storage locker, then it will be lost
to me and may end up on reality TV.  The list goes on.

Apple computers running 10.5 or less get no updates (comprising
about half the installed base).  Any Microsoft computer running XP
gets no updates (comprising about half the installed base).  The
end of security updates follows abandonment.  It is certainly ironic
that freshly pirated copies of Windows get security updates when
older versions bought legitimately do not.

Stating the obvious, if Company X abandons a code base, then that
code base should be open sourced.  Irrespective of security issues,
many is the time that a bit of software I use has gone missing
because its maker went missing.  But with respect to security, some
constellation of {I,we,they,you} are willing and able to provide
security patches or workarounds as time and evil require.

Would the public interest not be served, then, by a conversion to
open source for abandoned code bases?  But wait, you say, isn't
purchased software on a general purpose computer a thing of the
past?  Isn't the future auto-updated smartphone clients transacting
over armored private (carrier) networks to auto-updated cloud
services?  Maybe; maybe not.  If the two major desktop suppliers
update only half of today's desktops, then what percentage will
they update tomorrow?

If you say "Make them try harder!," then the legalistic, regulatory
position is your position, and the ACLU is already trying that
route.  If smartphone auto-update becomes a condition of merchantability
and your smartphone holds the keying material that undeniably says
that its user is you, then how long before a FISA court orders a
special auto-update to *your* phone for evidence gathering?

If you say "But we already know what they're going to do, don't
we?," then the question is what about the abandoned code bases.
Open-sourcing abandoned code bases is the worst option, except for
all the others.  But if seizing an abandoned code base is too big
a stretch for you before breakfast, then start with a Public Key
Infrastructure Certifying Authority that goes bankrupt and ask "Who
gets the keys?"

Trend #6: Interdependence

The essential character of a free society is this: That which is
not forbidden is permitted.  The essential character of an unfree
society is the inverse, that which is not permitted is forbidden.
The U.S. began as a free society without question; the weight of
regulation, whether open or implicit, can only push it toward being
unfree.  Under the pressure to defend against offenders with a
permanent structural advantage, defenders who opt for forbidding
anything that is not expressly permitted are cultivating a computing
environment that does not embody the freedom with which we are
heretofore familiar.

Put concretely, the central expression of a free society is a free
market, and the cardinal measure of a free market is the breadth
of real choice -- choice that goes beyond color and trim and body
style to choices that optimize discordant, antithetical goal states.
The level of choice on the Internet is draining down.  You may revel
in the hundreds of thousands of supposedly new voices that have
found a way to chatter in full view.  You may note that new "apps"
for Android plus iPhone are appearing at over a thousand per day.
You may rightly remind us all that technology is democratizing in
the sense that powers once reserved for the few are now irretrievably
in the hands of the many.  What stands against that, and why I say
that it stands against that, is increasing interdependence.

We humans can design systems more complex than we can then operate.
The financial sector's "flash crashes" are an example of that;
perhaps the fifty interlocked insurance exchanges for Obamacare
will soon be another.  Above some threshold of system complexity,
it is no longer possible to test, it is only possible to react to
emergent behavior.  The lowliest Internet user is entirely in the
game of interdependence -- one web page can easily touch scores of
different domains.  While writing this, the top level page from
cnn.com had 400 out-references to 85 unique domains each of which
is likely to be similarly constructed and all of which move data
one way or another.  If you leave those pages up and they have an
auto-refresh, then moving to a new network signals to every one of
those ad networks that you have so moved.

The wellspring of risk is dependence, especially dependence on
shared expectations of shared system state, i.e., interdependence
on the ground.  If you would accept that you are most at risk from
the things you most depend upon, then damping dependence is the
cheapest, most straightforward, lowest latency way to damp risk,
just as the fastest and most reliable way to put more money on a
business's bottom line is through cost control.

Trend #7: Automation

Shoshana Zuboff of the Harvard Business School notably described
three laws of the digital age,

. Everything that can be automated will be automated.
. Everything that can be informated will be informated.
. Every digital application that can be used for surveillance and
.    control will be used for surveillance and control.

It is irrelevant, immaterial and incompetent to argue otherwise.
For security technology, Zuboff's Laws are almost the goal state,
that is to say that the attempt to automate information assurance
is in full swing everywhere, the ability to extract information
from the observable is in full swing everywhere, and every digital
application is being instrumented.

Before In-Q-Tel, I worked for a data protection company.  Our product
was, and I believe still is, the most thorough on the market.  By
"thorough" I mean the dictionary definition, "careful about doing
something in an accurate and exact way."  To this end, installing
our product instrumented every system call on the target machine.
Data did not and could not move in any sense of the word "move"
without detection.  Every data operation was caught and monitored.
It was total surveillance data protection.  What made this product
stick out was that very thoroughness, but here is the point: Unless
you fully instrument your data handling, it is not possible for you
to say what did not happen.  With total surveillance, and total
surveillance alone, it is possible to treat the absence of evidence
as the evidence of absence.  Only when you know everything that
*did* happen with your data can you say what did *not* happen with
your data.

But this trend of automating is now leaving the purely defensive
position behind.  In a press release two weeks ago today,[7] DARPA
signaled exactly that, and I quote

   [T]he Defense Advanced Research Projects Agency intends to hold
   the Cyber Grand Challenge -- the first-ever tournament for fully
   automatic network defense systems.  DARPA envisions teams creating
   automated systems that would compete against each other to
   evaluate software, test for vulnerabilities, generate security
   patches and apply them to protected computers on a network.  The
   growth trends ... in cyber attacks and malware point to a future
   where automation must be developed...

The automation trend is irreversible, but it begs a question that
I fear no one will answer in a way that doesn't merely reflect their
corporate or institutional interest, namely are people in the loop
a failsafe or a liability?[8]

Trend #8: Dual use

I've become convinced that all security technology is dual use.
While I am not sure whether dual use is a trend or a realization
of an unchanging fact of nature, the obviousness of dual use seems
greatest in the latest technologies, so I am calling it a trend in
the sense that the straightforward accessibility of dual use
characteristics of new technology is a growing trend.

There are a lot of examples, but in the physical world any weapon
usable for defense can be repurposed for offense.  Every security
researcher looking for exploitable flaws is deep in the dual use
debate because once discovered, those flaws can be patched or they
can be sold.  The cyber security products that promise total
surveillance over the enterprise are, to my mind, an offensive
strategy used for defensive purposes.

There was a time when flaws were predominantly found by adventurers
and braggarts.  Ten plus years of good work by the operating system
vendors elbowed the flaw finders out of the operating system and,
as a result, our principal opponents changed over from adventurers
and braggarts to being professionals.  Finding vulnerabilities and
exploiting them is now hard enough that it has moved out of the
realm of being a hobby and into the realm of being a job.  This
changed several things, notably that braggarts share their findings
because they are paid in bragging rights.  By contrast, professionals
do not share and are paid in something more substantial than fame.
The side effect has been a continued rise in the percentage of all
vulnerabilities that are previously unknown.  The trend, in other
words, is that by crushing hobbyists we've raised the market price
of working exploits to where now our opponents pay for research and
development out of revenue.

Simulating what the opponent can do thus remains the central task
of defensive research.  Much of that research is in crafting proofs
of concept that such and such a flaw can be taken advantage of.
Corman's neologism of "HD Moore's Law" says that the trend in the
power of the casual attacker grows as does the trend of the power
in Metasploit.[9] It is hard to think of a better description of
dual use.

Trend #9: The blurring of end-to-end

To my mind, the most important technical decision ever made was
that the security of the Internet was to be "end-to-end."[10]
"End-to-end" is a generic technical term yet simple to explain: the
Internet was built on the premise that two entities could connect
themselves to each other and decide what they wanted to do.  The
network was a delivery vehicle, but the form, content, and security
of the connection between the two ends was to be their own choice.
End-to-end is a model where the terminal entities are smart and the
network is dumb.  This is completely (completely) different than a
smart network with dumb terminal entities at the end of the wire.
No other design decision of the Internet comes close to the importance
of it's being an end-to-end design.  With end-to-end, security is
the choice of the terminal end-points, not something built into the
fabric of the Internet itself.  That is American values personified.
It is the idea that accountability, not permission seeking, is the
way a government curbs the misuse of freedoms, and, as accountability
scales but permission seeking does not, accountability wins.

End-to-end security is the digital manifestation of the right of
association and, in any case, is what enabled the Internet to become
relevant in the first place.  End-to-end does precisely what Peter
Drucker told us to do: "Don't solve problems, create opportunities."
The provision of content from anywhere to anywhere, which is the
very purpose of an internetwork, is a challenge to sovereignty.
America's Founders wanted no sovereign at all, and they devised a
government that made the center all but powerless and the periphery
fully able to thumb its nose at whatever it felt like.  Much ink
has been spilled on the frontier ethic versus the wishful policies
favored by the comfortable urbanity of the welfare state, but the
Internet's protocols have everything in common with the former and
nothing in common with the latter.

The free man requires the choice of with what degree of vigor to
defend himself.  That is a universal; America's Founders laid that
down in the Second Amendment, just as did George Orwell in the
English democratic socialist weekly "Tribune" when he said, "That
rifle on the wall of the laborer's cottage or working class flat
is the symbol of democracy.  It is our job to see that it stays
there."  Were George Washington or George Orwell still among us,
they would know that smart end-points and dumb networks are what
freedom requires, that smart networks protecting dumb end-points
breed compliant dependency.

But the trend is otherwise, and not just because of the fatuous
fashionability of entitlement, but rather because of a blurring of
what the term "end" means.  So very many people have adopted automatic
synchronization of multiple devices they own that one has to ask
whether their tablet is an end or their collection of mutually
synchronized devices is an end.  So many Internet-dependent functions
are spread silently across numerous entities and applications that
what is the end may well be more dynamic than can be described.  If
an end implies unitary control on the part of an owner, then set
theory says that mutually synchronized devices are a unitary end.

That blurring of "end" makes end-to-end provisioning problematic
as a set of devices cannot be assumed to be equally on and equally
participating in any given transaction.  Quoting Clark & Blumenthal[11]

   There is a risk that the range of new requirements now emerging
   could have the consequence of compromising the Internet's original
   design principles.  Were this to happen, the Internet might lose
   some of its key features, in particular its ability to support
   new and unanticipated applications.  We link this possible outcome
   to a number of trends: the rise of new stakeholders in the
   Internet,...  new government interests, the changing motivations
   of the growing user base, and the tension between the demand for
   trustworthy overall operation and the inability to trust the
   behavior of individual users.

This is nowhere so evident as in security, that is to say in the
application of the end-to-end principle to cyber security.  What
does end-to-end secure transport mean when travelocity.com is showing
you a page dynamically constructed from a dozen other entities?

Trend #10: Complexity in the supply chain

Even without resorting to classified information, it is now clear
that supply chain attacks have occurred.  Whether reading journalistic
accounts or Richard Clarke's novel _Breakpoint_, the finding is
that the supply chain creates opportunities for badness.  None of
the things I've yet read, however, blames the supply chain risk on
its complexity, per se, but that is the trend that matters.

Security is non-composable -- we can get insecure results even when
our systems are assembled from secure components.  The more components,
the less likely a secure result.  This applies to supply chains
that are growing ever more complex under the pressure of just-in-time,
spot market sourcing of, say, memory chips and so forth and so on.
Because the attacker has only to find one component of that chain
to be vulnerable while the defender has to assure that all components
are invulnerable, rising supply chain complexity guarantees increased
opportunity for effective attack.  It cannot do otherwise, and the
trend is clear.

Trend #11: Monoculture(s)

Beginning with Forrest in 1997,[12] regular attention has been paid
to the questions of monoculture in the network environment.  There
is no point belaboring the fundamental question, but let me state
it for the record: cascade failure is so very much easier to detonate
in a monoculture -- so very much easier when the attacker has only
to write one bit of malware, not ten million.  The idea is obvious;
believing in it is easy; acting on its implications is, evidently,
rather hard.

I am entirely sympathetic to the actual reason we continue to deploy
computing monocultures -- making everything almost entirely alike
is, and remains, our only hope for being able to centrally manage
it in a consistent manner.  Put differently, when you deploy a
computing monoculture you are making a fundamental risk management
decision: That the downside risk of a black swan event is more
tolerable than the downside risk of perpetual inconsistency.  This
is a hard question, as all risk management is about changing the
future, not explaining the past.  Which would you rather have, the
unlikely event of a severe impact, or the day-to-day burden of
perpetual inconsistency?

When we opt for monocultures we had better opt for tight central
control.  This supposes that we are willing to face the risks that
come with tight central control, of course, including the maximum
risk of all auto-update schemes, namely the hostile takeover of the
auto-update mechanism itself.  Computer desktops are not the point;
embedded systems are.  The trendline in the number of critical
monocultures seems to be rising and many of these are embedded
systems both without a remote management interface and long lived.
That combination -- long lived and not reachable -- is the trend
that must be reversed.  Whether to insist that embedded devices
self destruct at some age or that remote management of them be a
condition of deployment is the question.  In either case, the
Internet of Things and the appearance of microcontrollers in seemingly
every computing device should raise hackles on every neck.[13]

Trend #12: Attack surface growth versus skill growth

Everyone here knows the terminology "attack surface" and knows that
one of the defender's highest goals is to minimize the attack surface
wherever possible.  Every coder adhering to a security-cognizant
software lifecycle program does this.  Every company or research
group engaged in static analysis of binaries does this.  Every
agency enforcing a need-to-know regime for data access does this.
Every individual who reserves one low-limit credit card for their
Internet purchases does this.  I might otherwise say that any person
who encrypts their e-mail to their closest counterparties does this,
but because consistent e-mail encryption is so rare, encrypting
one's e-mail marks it for collection and indefinite retention by
those entities in a position to do so, regardless of what country
you live in.

In cyber security practice, the trend is that we practitioners as
a class are getting better and better.  We have better tools, we
have better understood practices, and we have more colleagues.
That's the plus side.  But I'm interested in the ratio of skill to
challenge, and as far as I can estimate, we are expanding the
society-wide attack surface faster than we are expanding our
collection of tools, practices, and colleagues.  If you are growing
more food, that's great.  If your population is growing faster than
your improvements in food production can keep up, that's bad.

In the days of radio, there was Sarnoff's Law, namely that the value
of a broadcast network was proportional to N, the number of listeners.
Then came packetized network communications and Metcalfe's Law,
that the value of a network was proportional to N squared, the
number of possible two-way conversations.  We are now in the era
of Reed's Law where the value of a network is proportional to the
number of groups that can form in it, that is to say 2 to the power
N.  Reed's Law is the new reality because it fits the age of social
networks.  In each of these three laws as publicly stated, the sign
bit is positive, but in parallel with the claim that everything is
dual use, the sign bit can also be negative because interconnections
are a contributor to the net attack surface.  If an Internet of
Things is indeed imminent, then the upward bend in the curve of the
global attack surface will grow steeper regardless of what level
of risk there is for any one thing so long as that level of risk
is always non-zero.

Trend #13: Specialization

Everyone my age working in cyber security was trained for something
else, and because of that switch between one field and another
brings along the hybrid vigor of seeing the cyber security world
through a different lens.  Statisticians, civil engineers, and
lawyers alike can contribute.  But the increasing quality of prepatory
education, the increasing breadth of affairs for which cyber security
is needful, and the increasing demand for skill of the highest sort
means the humans in the game are specializing.

While some people like to say "Specialization is for insects," tell
me that the security field itself is not specializing.  We have
people who are expert in forensics on specific operating system
localizations, expert in setting up intrusion response, expert in
analyzing large sets of firewall rules using non-trivial set theory,
expert in designing egress filters for universities that have no
ingress filters, expert in steganographically watermarking binaries,
and so forth.  Generalists are becoming rare, and they are being
replaced by specialists.  This is biologic speciation in action,
and the narrowing of ecologic niches.  In rough numbers, there are
somewhere close to 5,000 various technical certifications you can
get in the computer field, and the number of them is growing thus
proving the conjecture of specialization and speciation is not just
for insects and it will not stop.

--------------

What does it all mean?

All of these trends reflect state changes ongoing and likely to
continue to move forward.  If we could count on them to maintain
some smooth progression, then we might plan actions around them,
but we cannot.  At any moment, a game changer may arrive, but that
is not something you can plan for, per se.

I began with the trend of polarization and I end with it.  The range
of cyber security skills between the best and the worst is growing
wider.  As the worst outnumber the best and always will, we need
look no further than the history of empire where, in the end, it
is polarization that kills them.  The Internet is an empire.  The
Internet was built by academics, researchers, and hackers -- meaning
that it embodies the liberal cum libertarian cultural interpretation
of "American values," namely that it is open, non-hierarchial, self
organizing, and leaves essentially no opportunities for governance
beyond a few rules of how to keep two parties in communication over
the wire.  Anywhere the Internet appears, it brings those values
with it.  Other cultures, other governments, know that these are
our strengths and that we are dependent upon them, hence as they
adopt the Internet they become dependent on those strengths and
thus on our values.  A greater challenge to sovereignty does not
exist, which is why the Internet will either be dramatically
balkanized or it will morph into an organ of world government.  In
either case, the Internet will never again be as free as it is this
morning.

That polarization of cyber security within the Internet grows from
our willing dependence on it despite the other trends of which I've
spoken.  I don't see us deciding to damp that risk by curbing
dependence though, to be clear, that is precisely the trajectory
which my own life now follows.  I don't see the cyber security field
solving the problem as the problem to be solved is getting bigger
faster than we are getting better.  I see, instead, the probability
that legislatures will relieve the more numerous incapable of the
joint consequences of their dependence and their incapability by
assigning liability so as to collectivize the downside risk of cyber
insecurity into insurance pools.  We are forcibly collectivizing
the downside risk of disease most particularly the self-inflicted
ones, why would we not do that for the downside risk of cyber
insecurity and, again, particularly the self-inflicted ones?

Where there are so many questions and so few answers, such deep
needs and such shallow appreciation of trend directions, the greatest
risk is the risk of simplistic solutions carried forward by charismatic
fools.

There is never enough time, thank you for yours.


--------------

[1] "Professionalizing the Nation's Cyber Workforce?"
 www.nap.edu/openbook.php?record_id=18446

[2] _Hollowing out the Middle_, Carr & Kefalas; _Race Against the
Machine_, Brynjolfsson & McAfee; _Average Is Over_, Cowen

[3] "The Index of Cyber Security,"
 cybersecurityindex.org

[4] "The Consumer Confidence Index," Technical Note, 2011
 tinyurl.com/3sb633k

[5] Gray, "eScience," NRC-CSTB, Mountain View CA, 2007
 research.microsoft.com/en-us/um/people/gray/talks/NRC-CSTB_eScience.ppt

[6] Geer, _Economics and Strategies of Data Security_, 2008

[7] www.darpa.mil/NewsEvents/Releases/2013/10/22.aspx

[8] Geer, "People in the Loop: Failsafe or a Liability?", 2012
 geer.tinho.net/geer.suitsandspooks.8ii12.txt

[9] Corman, "Intro to HDMoore's Law," 2011
 blog.cognitivedissidents.com/2011/11/01/intro-to-hdmoores-law

[10] Saltzer, Reed, & Clark, "End-to-End Arguments in System Design,"
1981
 web.mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf

[11] Clark & Blumenthal, "Rethinking the design of the Internet,
The End-to-End Arguments vs. the Brave New World," 2001
 cyberlaw.stanford.edu/e2e/papers/TPRC-Clark-Blumenthal.pdf

[12] Forrest, Somayaji, & Ackley, "Building Diverse Computer Systems,"
HotOS-VI, 1997
 www.cs.unm.edu/~immsec/publications/hotos-97.pdf

[13] Farmer, "IPMI: Freight Train to Hell v2.01," 2013
 fish2.com/ipmi/itrain.pdf


more material at geer.tinho.net/pubs




From pgut001 at cs.auckland.ac.nz  Mon Dec  2 01:34:54 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Mon, 02 Dec 2013 22:34:54 +1300
Subject: NSA: The Game
Message-ID: <E1VnPu2-0008T2-Tg@login01.fos.auckland.ac.nz>

For those of you familiar with the game Werewolf (also known as Mafia), here's
an updated version, NSA.

Peter.

-- Snip --

                                     NSA 
                                     ===

                      Peter Gutmann, 11 November 2013.
              Adapted from a Werewolf writeup found on Zarfhome.
          http://www.cs.auckland.ac.nz/~pgut001/pubs/nsa_werewolf.txt

NSA is a simple game for a largeish group of people, ten or more is best.  It
requires no equipment apart from some playing cards, or even just bits of
paper.  You can play it by simply sitting in a circle, but sitting around a
table works better (there's room for drinks and snacks).

Setting Up

Make up a set of cards, one for each player, with a role on each one:

    Two NSA agents (Werewolves in the original)
    One Edward Snowden (Seer in the original)
    One EFF member (Healer in the original)
    All the rest are Internet users (Villagers in the original)

The cards can be anything from fancy custom ones with the NSA logo and other
graphics representing the players' roles, through to a convenient pack of Dora
the Explorer cards with N, S, and E scrawled on a few of them.

In addition to the players there's a moderator who runs things.  The moderator
shuffles the cards and hands them out, face down.  Each player should look at
their card without revealing it to anyone else.  If there are more than about
15 players then the number of NSA agents, Snowdens, and EFF members can be
increased.

Two players are secretly NSA agents.  They are trying to apply extraordinary
rendition to all of the Internet users.  Everyone else is an innocent Internet
user, but one of the Internet users, Snowden, secretly has inside access to
classified information and can detect the presence of NSA agents.  In addition
another Internet user is an EFF member and can protect one player per turn
from the NSA's extraordinary rendition.

The Game: Night and Day

The game begins with each player introducing themselves.  The standard formula
for this is "Hi, my name is <insert name here> and I'm an innocent Internet
user".  This can be embellished as required with additional comments.  Once
everyone has been introduced, the game proceeds in alternating night and day
phases, beginning with night.  At night, the moderator tells all of the
players "Night has fallen, close your eyes".

The moderator then says "NSA, open your eyes".  The two NSA agents do so, and
look around to recognize each other.  The moderator should also note who the
NSA agents are.

The moderator says "NSA agents, pick someone to render".  The two NSA agents
silently agree on one Internet user to subject to extraordinary rendition.
It's important that they remain silent while doing this, pointing at the
victim works best.  When the NSA have agreed on a victim and the moderator
understands who they picked, the moderator says "NSA agents, close your eyes".

The moderator says "Snowden, open your eyes.  Snowden, pick someone to check".
Snowden opens his eyes and points at another player (as for the NSA agents,
this has to be silent).  The moderator signs thumbs-up (or some similar yes-
gesture) if Snowden pointed at an NSA agent, and shakes their head (or some
similar no-gesture) if the Snowden pointed at an innocent Internet user.  The
moderator then says "Snowden, close your eyes".

Finally, the moderator says "EFF member, open your eyes.  EFF member, pick
someone to protect".  The EFF member opens his/her eyes and, as with the
others, points at another player.  The moderator then says "EFF member, close
your eyes".  In the initial rounds its best if the EFF member protects
themselves.  If and when Snowden identifies himself, the EFF member should
protect Snowden in order to prevent him from being subject to extraordinary
rendition by the NSA.

The moderator says "Everybody open your eyes.  It's daytime, and <insert
victim name> has been subject to extraordinary rendition".  The named person
is immediately out of the game, and typically leaves the table or circle so
that only active players remain.  He or she can't say anything involving the
game beyond this point, but would typically sit at the periphery and watch the
game continue.

Now it's daytime.  All of the remaining players decide who to lynch as a
suspected NSA agent.  Anyone can say anything they want.  NSA agents can claim
to be Edward Snowden and "unmask" NSA agents who are actually innocent
Internet users.  Players can privately whisper things to other players (for
example claiming to be Snowden, or the EFF member), or secretly pass notes.
Any excuse to lynch someone is valid, for example because they have a beard,
because they're Australian, or because they took the last potato chip.

The real Edward Snowden should remain silent until they've identified at least
one NSA agent, since they'll be an immediate target for extraordinary
rendition if they reveal themselves too early.  Similarly, the EFF member
shouldn't reveal their identity unless absolutely necessary, since they need
to protect Snowden without being themselves rendered by the NSA.

Once a majority of players vote for a particular player to die (the player can
be allowed to defend themselves, for example by claiming that "we, too, are
Internet users", leading to further votes), the moderator says "<insert-name>
has been lynched as a suspected NSA agent and is now dead".  The player leaves
the game in the same way as those subject to extraordinary rendition.  If the
players take too long to decide, the moderator can hint that night is about to
fall, and if they still dither, night will fall without anyone being lynched.

At this point the cycle repeats.  Everyone closes their eyes, the NSA agent(s)
select another person to subject to extraordinary rendition, Snowden (if
alive) learns another player's identity, and the EFF member (if alive)
protects another player.  The sun rises, one player is rendered (unless
protected by the EFF member), and the remaining players discuss another
lynching.  Repeat until one side wins.

Winning

The Internet users win if they kill all of the NSA agents.  The NSA agents win
if they render enough Internet users that the numbers of Internet users and
NSA agents are even.  In other words they win if the NSA agents constitute a
large enough voting bloc that they can't be lynched any more.  At that point
the NSA can unmask and openly subject the remaining Internet users to
extraordinary rendition.

Notes

When everyone closes their eyes at night, it's best for people to make some
sort of noise, typically tapping the table.  This will cover up any accidental
sounds that are made by the NSA agents, Snowden, the EFF member, or the
moderator.

Once a player is lynched or rendered, there are two options on what to do with
their cards, show or no-show.  The show option is easiest, particularly for
the initial games.  With this option the player reveals their card, so that
the other players know what sort of person has been eliminated.  The no-show
option is harder but a lot more fun.  With this option the player doesn't
reveal their card, so that the other players have no idea who's still left in
the game.




From dan at geer.org  Mon Dec  2 20:11:20 2013
From: dan at geer.org (dan at geer.org)
Date: Mon, 02 Dec 2013 23:11:20 -0500
Subject: trends in cybersecurity
Message-ID: <20131203041120.82D5A2280BA@palinka.tinho.net>


Given last month as keynote to the National Reconnaissance
Office's planning conference.

Trends in Cyber Security
http://geer.tinho.net/geer.nro.6xi13.txt

Respectfully,

--dan




From cathalgarvey at cathalgarvey.me  Mon Dec  2 16:10:29 2013
From: cathalgarvey at cathalgarvey.me (Cathal Garvey)
Date: Tue, 3 Dec 2013 00:10:29 +0000
Subject: ntru-crypto - Open Source NTRU Public Key Cryptography
 Algorithm and Reference Code
In-Reply-To: <87vbz9k9qx.fsf@michiru.Home>
References: <CAJVRA1T8MtuZ6L+p7KEVr2OSm9-tUZ72y7V+ck8_fJdwbwhpow@mail.gmail.com>
 <87vbz9k9qx.fsf@michiru.Home>
Message-ID: <20131203001029.07985c2e@Neptune>

> Haven't we made the mistake of relying on someone else's IP for crypto
> before? I'm looking at you, RSA and IDEA. I have no interest in a
> cryptosystem that's owned by someone and that requires me to release
> my own software under a particular license to use it. I don't care how
> technologically superior it might be.

The GPL doesn't require you to release a cryptosystem under the GPL,
only code for that cryptosystem that derives from GPL'd code. The GPL
in effect is a tragedy-of-the-commons-killomatic: It's an agreement
between me and you saying "I give you my code, if you give it to
others". There's nothing in there about "I offer you my code, and hit
you if you try to write your own instead".

Given that, I have very little time for GPL-haters, because they're
just being whiny bastards. Write your own if you don't like it.

Patents, on the other hand, are a whole different steaming pile of
shit, and NTRU is patented. So, I'm still with you on this one. If
they're somewhere where you can relinquish patents, they should do
that. If not, they should either grant the patents wholly to a public
trust, or put them under the DPL or similar and make an irrevocable
pledge never to use them except defensively, if even that.

Of course, who's to know if you implement or build on NTRU under a
'nym? It remains one of the only cryptosystems that's A) Practical and
B) Quantum-resistant.

Anyone know of any other quantum-resistant algos for *encryption* that
can actually be used today, other than NTRU?

On Sat, 30 Nov 2013 10:47:02 -0800
Sean Lynch <seanl at literati.org> wrote:

> On Wed, Nov 27 2013, coderman wrote:
> 
> > https://github.com/NTRUOpenSourceProject/ntru-crypto
> 
> > """
> > Security Innovation, Inc., the owner of the NTRU public key
> > cryptography system, made the intellectual property and a sample
> > implementation available under the Gnu Public License (GPL) in 2013
> > with the goal of enabling more widespread adoption of this superior
> > cryptographic technology. The system is also available for
> > commercial use under the terms of the Security Innovation
> > Commercial License.
> 
> Haven't we made the mistake of relying on someone else's IP for crypto
> before? I'm looking at you, RSA and IDEA. I have no interest in a
> cryptosystem that's owned by someone and that requires me to release
> my own software under a particular license to use it. I don't care how
> technologically superior it might be.
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/28fd7d3a/attachment.sig>

From cathalgarvey at cathalgarvey.me  Mon Dec  2 16:16:18 2013
From: cathalgarvey at cathalgarvey.me (Cathal Garvey)
Date: Tue, 3 Dec 2013 00:16:18 +0000
Subject: ntru-crypto - Open Source NTRU Public Key Cryptography
 Algorithm and Reference Code
In-Reply-To: <20131203001029.07985c2e@Neptune>
References: <CAJVRA1T8MtuZ6L+p7KEVr2OSm9-tUZ72y7V+ck8_fJdwbwhpow@mail.gmail.com>
 <87vbz9k9qx.fsf@michiru.Home> <20131203001029.07985c2e@Neptune>
Message-ID: <20131203001618.2f1719df@Neptune>

's_*encryption*_*asymmetric encryption*_g'

..given that we've got plenty of options for quantum-resistant
*symmetric* crypto, and several painful-but-sound options for
quantum-resistant signature schemes; Merkle-Lamport, for example.

On Tue, 3 Dec 2013 00:10:29 +0000
Cathal Garvey <cathalgarvey at cathalgarvey.me> wrote:

> > Haven't we made the mistake of relying on someone else's IP for
> > crypto before? I'm looking at you, RSA and IDEA. I have no interest
> > in a cryptosystem that's owned by someone and that requires me to
> > release my own software under a particular license to use it. I
> > don't care how technologically superior it might be.
> 
> The GPL doesn't require you to release a cryptosystem under the GPL,
> only code for that cryptosystem that derives from GPL'd code. The GPL
> in effect is a tragedy-of-the-commons-killomatic: It's an agreement
> between me and you saying "I give you my code, if you give it to
> others". There's nothing in there about "I offer you my code, and hit
> you if you try to write your own instead".
> 
> Given that, I have very little time for GPL-haters, because they're
> just being whiny bastards. Write your own if you don't like it.
> 
> Patents, on the other hand, are a whole different steaming pile of
> shit, and NTRU is patented. So, I'm still with you on this one. If
> they're somewhere where you can relinquish patents, they should do
> that. If not, they should either grant the patents wholly to a public
> trust, or put them under the DPL or similar and make an irrevocable
> pledge never to use them except defensively, if even that.
> 
> Of course, who's to know if you implement or build on NTRU under a
> 'nym? It remains one of the only cryptosystems that's A) Practical and
> B) Quantum-resistant.
> 
> Anyone know of any other quantum-resistant algos for *encryption* that
> can actually be used today, other than NTRU?
> 
> On Sat, 30 Nov 2013 10:47:02 -0800
> Sean Lynch <seanl at literati.org> wrote:
> 
> > On Wed, Nov 27 2013, coderman wrote:
> > 
> > > https://github.com/NTRUOpenSourceProject/ntru-crypto
> > 
> > > """
> > > Security Innovation, Inc., the owner of the NTRU public key
> > > cryptography system, made the intellectual property and a sample
> > > implementation available under the Gnu Public License (GPL) in
> > > 2013 with the goal of enabling more widespread adoption of this
> > > superior cryptographic technology. The system is also available
> > > for commercial use under the terms of the Security Innovation
> > > Commercial License.
> > 
> > Haven't we made the mistake of relying on someone else's IP for
> > crypto before? I'm looking at you, RSA and IDEA. I have no interest
> > in a cryptosystem that's owned by someone and that requires me to
> > release my own software under a particular license to use it. I
> > don't care how technologically superior it might be.
> > 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/c033f52f/attachment.sig>

From cathalgarvey at cathalgarvey.me  Mon Dec  2 16:17:29 2013
From: cathalgarvey at cathalgarvey.me (Cathal Garvey)
Date: Tue, 3 Dec 2013 00:17:29 +0000
Subject: Jim Bell needs Bitcoins!
In-Reply-To: <529A0A5E.2080106@gogulski.com>
References: <1385370567.90180.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAFVRnyruheDLORaTjU=V6U3Z6m8XTjyzQYgA+psqWE=o1Y-k5g@mail.gmail.com>
 <1385421475.40988.YahooMailNeo@web141201.mail.bf1.yahoo.com>
 <CAFVRnyr1XVKf0f1KasBV_MBuH=P7+3XABQE2hur8M8BwZ-e6Pw@mail.gmail.com>
 <20131126003204.GK7523@hexapodia.org>
 <CABdoPv57xOUTRV+5DAO2R7MbYv7_u+mqEtV_JqBpuBrJW6kZJw@mail.gmail.com>
 <CAFVRnyrfvox-ZDpvWm5PThA3CSjSt55aB-7yp9bveEbbWB4JCA@mail.gmail.com>
 <20131126225653.F25A9F5F0@a-pb-sasl-quonix.pobox.com>
 <1385511819.20893.6.camel@anglachel>
 <CAHWD2rJBuQnna1tukXsN-NWZApm5d5hqAGAj6zO2d9MXXrzwjw@mail.gmail.com>
 <1385514403.20893.10.camel@anglachel>
 <CAHWD2rJxvzTVvm9QB0psOZop-iTDuR8T6qPyuMXKEpZHgLtx9g@mail.gmail.com>
 <1385578162.80373.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <CAHWD2r+9s1LL10PiAn1pOc5ZMhkFuh+nnM3xg17G6mzdjH4=dg@mail.gmail.com>
 <1385792924.64602.YahooMailNeo@web141202.mail.bf1.yahoo.com>
 <529A0A5E.2080106@gogulski.com>
Message-ID: <20131203001729.38d2433f@Neptune>

"Guy who publicly advocates spending anonymous currency to fund murder
needs anonymous currency!"

er, no.

On Sat, 30 Nov 2013 16:55:10 +0100
Mike Gogulski <mike at gogulski.com> wrote:

> Jim, install a wallet and send me an address. I'll send you some
> coin :)
> 
> 
> On 11/30/2013 07:28 AM, Jim Bell wrote:
> > Presumably, relatively few people have read the paper.  I am
> > embarrassed to say that I only started paying close attention to
> > bitcoin 2 months ago.  <sigh>  And I still don't own any.
> >       Jim Bell
> >
> > ------------------------------------------------------------------------
> > *From:* Lodewijk andré de la porte <l at odewijk.nl>
> > *To:* Jim Bell <jamesdbell8 at yahoo.com>
> > *Cc:* "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>;
> > "tedks at riseup.net" <tedks at riseup.net>
> > *Sent:* Wednesday, November 27, 2013 11:36 AM
> > *Subject:* Re: bitcoin as a global medium of exchange (was Re:
> > Interesting take on Sanjuro's Assassination Market)
> >
> > 2013/11/27 Jim Bell <jamesdbell8 at yahoo.com
> > <mailto:jamesdbell8 at yahoo.com>>
> >
> >     This difference is not defined by a law of nature, it is defined
> >     by algorithm and software.  And I strongly doubt that many
> > people (other than Satoshi) realized this in 2009.
> >
> >
> > I realized it shortly after reading the paper. Then checked the
> > realization for a few days before switching the denomination of my
> > savings. 2011
> >
> >
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/56cab90f/attachment.sig>

From l at odewijk.nl  Mon Dec  2 16:36:53 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Tue, 3 Dec 2013 01:36:53 +0100
Subject: Jim Bell needs Bitcoins!
In-Reply-To: <20131203001729.38d2433f@Neptune>
References: <1385370567.90180.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAFVRnyruheDLORaTjU=V6U3Z6m8XTjyzQYgA+psqWE=o1Y-k5g@mail.gmail.com>
 <1385421475.40988.YahooMailNeo@web141201.mail.bf1.yahoo.com>
 <CAFVRnyr1XVKf0f1KasBV_MBuH=P7+3XABQE2hur8M8BwZ-e6Pw@mail.gmail.com>
 <20131126003204.GK7523@hexapodia.org>
 <CABdoPv57xOUTRV+5DAO2R7MbYv7_u+mqEtV_JqBpuBrJW6kZJw@mail.gmail.com>
 <CAFVRnyrfvox-ZDpvWm5PThA3CSjSt55aB-7yp9bveEbbWB4JCA@mail.gmail.com>
 <20131126225653.F25A9F5F0@a-pb-sasl-quonix.pobox.com>
 <1385511819.20893.6.camel@anglachel>
 <CAHWD2rJBuQnna1tukXsN-NWZApm5d5hqAGAj6zO2d9MXXrzwjw@mail.gmail.com>
 <1385514403.20893.10.camel@anglachel>
 <CAHWD2rJxvzTVvm9QB0psOZop-iTDuR8T6qPyuMXKEpZHgLtx9g@mail.gmail.com>
 <1385578162.80373.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <CAHWD2r+9s1LL10PiAn1pOc5ZMhkFuh+nnM3xg17G6mzdjH4=dg@mail.gmail.com>
 <1385792924.64602.YahooMailNeo@web141202.mail.bf1.yahoo.com>
 <529A0A5E.2080106@gogulski.com> <20131203001729.38d2433f@Neptune>
Message-ID: <CAHWD2rJpwooCS+Z=FYArPPiwWspSpOd5HVX5WKfKD_eJT1UfAA@mail.gmail.com>

On Dec 3, 2013 1:18 AM, "Cathal Garvey" <cathalgarvey at cathalgarvey.me>
wrote:
>
> "Guy who publicly advocates spending anonymous currency to fund murder
> needs anonymous currency!"
>
> er, no.

Doesn't mean he would do it or even like it. Damn square.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 410 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/8ba9cd29/attachment.txt>

From mail at larsluthman.net  Mon Dec  2 17:23:54 2013
From: mail at larsluthman.net (Lars Luthman)
Date: Tue, 03 Dec 2013 02:23:54 +0100
Subject: ntru-crypto - Open Source NTRU Public Key Cryptography
 Algorithm and Reference Code
In-Reply-To: <20131203001029.07985c2e@Neptune>
References: <CAJVRA1T8MtuZ6L+p7KEVr2OSm9-tUZ72y7V+ck8_fJdwbwhpow@mail.gmail.com>
 <87vbz9k9qx.fsf@michiru.Home> <20131203001029.07985c2e@Neptune>
Message-ID: <1386033834.5886.98.camel@miskatonic>

On Tue, 2013-12-03 at 00:10 +0000, Cathal Garvey wrote: 
> Anyone know of any other quantum-resistant algos for *encryption* that
> can actually be used today, other than NTRU?

There is McBits which is supposed to be blazingly fast, but the keys are
very large which makes it unsuitable for everything except fixed-key
systems like PGP.


--ll
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/65894cec/attachment.sig>

From pgut001 at cs.auckland.ac.nz  Mon Dec  2 11:54:40 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Tue, 03 Dec 2013 08:54:40 +1300
Subject: NSA: The Game
In-Reply-To: <CAABhiFw_+WoVMdoB=eUnL8gZb62NsO0D8B_Vv5kXM0VuyAmo6A@mail.gmail.com>
Message-ID: <E1VnZZo-0006Xb-3Z@login01.fos.auckland.ac.nz>

Pokokohua <pokokohua at gmail.com> writes:

>Would it work swapping renditions for drone strikes as an option?

Yep, that would work too, I'll add it as an option.  Also, when it was 
playtested here some folks found it easier to identify as the more traditional 
"villagers" rather than "Internet users", although I think it should really be 
"Internet users".

I'll be in San Jose on the weekend of the 14th if anyone wants to play a round 
or two of NSA.

Peter.




From jya at pipeline.com  Tue Dec  3 06:35:22 2013
From: jya at pipeline.com (John Young)
Date: Tue, 03 Dec 2013 09:35:22 -0500
Subject: Willis Ware Dies
Message-ID: <E1Vnr3h-00081C-Hq@elasmtp-curtail.atl.sa.earthlink.net>

Willis Ware dies, early computer engineer:

http://www.nytimes.com/2013/12/02/technology/willis-ware-who-helped-build-blueprint-for-computer-design-dies-at-93.html

Seminal computer security paper 1979:

http://cryptome.org/sccs.htm








From seanl at literati.org  Tue Dec  3 11:34:21 2013
From: seanl at literati.org (Sean Lynch)
Date: Tue, 03 Dec 2013 11:34:21 -0800
Subject: audiovisual (urls)
In-Reply-To: <1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com> (Jim
 Bell's message of "Mon, 2 Dec 2013 19:28:06 -0800 (PST)")
References: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>
 <1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com>
Message-ID: <87txepiv9e.fsf@michiru.Home>

On Mon, Dec 02 2013, Jim Bell wrote:

> My fiber optic invention has a certain relevance here. A typical
> modern germania-doped-core (GeO2) silica optical fiber has a loss of
> about 0.19 decibels/kilometer (db/km).  Over 50 km, the loss is (50
> km x 0.19 db/km) = 9.5 db, ignoring splice losses.  (A good splice
> has a loss of about 0.10 db.)  So, the quote above is indicating that
> above a loss of about 10 db, a quantum system is hard to maintain.  I
> have suggested in my patent application that isotope-modified fiber
> (where the Si-29 level is brought from nature's 4.67% (atom/atom) to
> 0.10 %, the loss might decrease by a factor of 10 to 20.  This means
> that the ultimate distance limit might increase to 50 x 10 = 500 km,
> to 50 x 20 = 1000 km.  That would be a major improvement if it works.
> The reason that this new fiber would be necessary is this:  Ever
> since the invention of the EDFA (Erbium-doped fiber amplifier  http:/
> /en.wikipedia.org/wiki/Optical_amplifier  ) in 1986, it has been used
> to amplify IR signals in the 1510-1560 nanometer band.  Using it and
> ordinary signals (not quantum signals) it is possible to go about 125
> kilometers between amplifiers.  (In other words, that usage tolerates
> about 25 db of optical loss before an EDFA is necessary.)  However,
> apparently an EDFA cannot be used to amplify a quantum system.  http:
> //www.nict.go.jp/en/press/2010/02/08-1.html     Or, at least, not
> directly.

While reducing loss will certainly help, the NICT paper you link to will
not. Quantum cryptography relies on only having a single entangled
particle going to each end, so that if anyone intercepts either particle
and attempts to measure whatever property you're using to derive the key
(polarization generally), the keys will not match because the quantum
state will be destroyed.

The paper you link to talks about creating large numbers of entangled
particles. While this is useful for sharing quantum computations over
long distances, it is not at all useful for quantum cryptography,
because one could intercept a small number of these particles, measure
them on each of the possible axes used for the cryptosystem, and figure
out the shared key.

-- 
Sean Richard Lynch <seanl at literati.org>
http://www.literati.org/~seanl/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/2dcf5bbc/attachment.sig>

From jamesdbell8 at yahoo.com  Tue Dec  3 12:35:36 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 3 Dec 2013 12:35:36 -0800 (PST)
Subject: audiovisual (urls)
In-Reply-To: <87txepiv9e.fsf@michiru.Home>
References: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>	<1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <87txepiv9e.fsf@michiru.Home>
Message-ID: <1386102936.42493.YahooMailNeo@web141203.mail.bf1.yahoo.com>

From: Sean Lynch <seanl at literati.org>


> My fiber optic invention has a certain relevance here. A typical
> modern germania-doped-core (GeO2) silica optical fiber has a loss of
> about 0.19 decibels/kilometer (db/km).  Over 50 km, the loss is (50
> km x 0.19 db/km) = 9.5 db, ignoring splice losses.  (A good splice
> has a loss of about 0.10 db.)  So, the quote above is indicating that
> above a loss of about 10 db, a quantum system is hard to maintain.  I
> have suggested in my patent application that isotope-modified fiber
> (where the Si-29 level is brought from nature's 4.67% (atom/atom) to
> 0.10 %, the loss might decrease by a factor of 10 to 20.  This means
> that the ultimate distance limit might increase to 50 x 10 = 500 km,
> to 50 x 20 = 1000 km.  That would be a major improvement if it works.
> The reason that this new fiber would be necessary is this:  Ever
> since the invention of the EDFA (Erbium-doped fiber amplifier  http:/
> /en.wikipedia.org/wiki/Optical_amplifier  ) in 1986, it has been used
> to amplify IR signals in the 1510-1560 nanometer band.  Using it and
> ordinary signals (not quantum signals) it is possible to go about 125
> kilometers between amplifiers.  (In other words, that usage tolerates
> about 25 db of optical loss before an EDFA is necessary.)  However,
> apparently an EDFA cannot be used to amplify a quantum system.  http:
> //www.nict.go.jp/en/press/2010/02/08-1.html     Or, at least, not
> directly.


>While reducing loss will certainly help, the NICT paper you link to will
>not. Quantum cryptography relies on only having a single entangled
>particle going to each end, so that if anyone intercepts either particle
>and attempts to measure whatever property you're using to derive the key
>(polarization generally), the keys will not match because the quantum
>state will be destroyed.

>The paper you link to talks about creating large numbers of entangled
>particles. While this is useful for sharing quantum computations over
>long distances, it is not at all useful for quantum cryptography,
>because one could intercept a small number of these particles, measure
>them on each of the possible axes used for the cryptosystem, and figure
>out the shared key.

Okay, thank you for clarifying this matter.  I merely Google-searched for  'EDFA quantum entanglement' and found and cited this paper, and that only because it referred to the problem of trying to amplify quantum signals through an EDFA.  
Myself, I am hoping that longer-key public-key cryptosystems will remain unsolved by quantum techniques, at least as long as it takes to get rid of governments.  After that, it probably won't matter.  As of now, it looks like things will go the way I'd like.
        Jim Bell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4136 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/749cced8/attachment.txt>

From anarchie+cpunks at metaverse.org  Mon Dec  2 20:05:09 2013
From: anarchie+cpunks at metaverse.org (Peter Tonoli)
Date: Tue, 03 Dec 2013 15:05:09 +1100
Subject: peertech.org cert [was: DEF CON cell network attacks]
In-Reply-To: <CAJVRA1QyF4hf63=8ozozuKX86T=mrZ7iVY_GGSUjhQvMZgDrDA@mail.gmail.com>
References: <CAJVRA1QyF4hf63=8ozozuKX86T=mrZ7iVY_GGSUjhQvMZgDrDA@mail.gmail.com>
Message-ID: <529D5875.10805@metaverse.org>

On 12/3/13, 12:56 PM, coderman wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> more details here soon...
>
> only 443 should be considered valid - that is,
>   try https://peertech.org first, plain-text must die.

All I get is "Authentication Required".. What is this?




From coderman at gmail.com  Tue Dec  3 15:40:25 2013
From: coderman at gmail.com (coderman)
Date: Tue, 3 Dec 2013 15:40:25 -0800
Subject: Fwd: [cryptography] A new approach to steganography
In-Reply-To: <CA+KqGkqyjboCm6N1sa=MVfFUd0qT+K1V1c8u_JO5a3oD2LF3Qw@mail.gmail.com>
References: <CA+KqGkqyjboCm6N1sa=MVfFUd0qT+K1V1c8u_JO5a3oD2LF3Qw@mail.gmail.com>
Message-ID: <CAJVRA1QjhsrnLVJqYgdNvd7k_jrNawZB_DnWHLppuxY4gTBa-g@mail.gmail.com>

---------- Forwarded message ----------
From: Bram Cohen <bram at bittorrent.com>
Date: Tue, Dec 3, 2013 at 11:27 AM
Subject: [cryptography] A new approach to steganography


I came up with a new approach to steganography. There's an
implementation and writeup of it here -

https://github.com/bramcohen/DissidentX




From coderman at gmail.com  Tue Dec  3 15:42:42 2013
From: coderman at gmail.com (coderman)
Date: Tue, 3 Dec 2013 15:42:42 -0800
Subject: [cryptography] A new approach to steganography
In-Reply-To: <CAJVRA1QjhsrnLVJqYgdNvd7k_jrNawZB_DnWHLppuxY4gTBa-g@mail.gmail.com>
References: <CA+KqGkqyjboCm6N1sa=MVfFUd0qT+K1V1c8u_JO5a3oD2LF3Qw@mail.gmail.com>
 <CAJVRA1QjhsrnLVJqYgdNvd7k_jrNawZB_DnWHLppuxY4gTBa-g@mail.gmail.com>
Message-ID: <CAJVRA1R+fWYbfem=J6qTM4NYvyJEzEY36atpsqvPg9R6SYKNMw@mail.gmail.com>

On Tue, Dec 3, 2013 at 3:40 PM, coderman <coderman at gmail.com> wrote:
> ...
> https://github.com/bramcohen/DissidentX


"""
Q. Why did you use Python3 as a reference language?

A. Because not having distinct binary and unicode string types is barbaric.
"""


oh the many ways i both love and hate python...




From seanl at literati.org  Tue Dec  3 22:14:41 2013
From: seanl at literati.org (Sean Lynch)
Date: Tue, 03 Dec 2013 22:14:41 -0800
Subject: audiovisual (urls)
In-Reply-To: <1386102936.42493.YahooMailNeo@web141203.mail.bf1.yahoo.com> (Jim
 Bell's message of "Tue, 3 Dec 2013 12:35:36 -0800 (PST)")
References: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>
 <1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <87txepiv9e.fsf@michiru.Home>
 <1386102936.42493.YahooMailNeo@web141203.mail.bf1.yahoo.com>
Message-ID: <87mwkhi1m6.fsf@michiru.Home>

On Tue, Dec 03 2013, Jim Bell wrote:

> Okay, thank you for clarifying this matter.  I merely Google-searched
> for  'EDFA quantum entanglement' and found and cited this paper, and
> that only because it referred to the problem of trying to amplify
> quantum signals through an EDFA. 

No problem. Not having read the actual paper, I'm not even sure what
they meant by "noise" preventing amplification of quantum signals in an
EDFA. Quantum states cannot be copied, which seems like a more
fundamental problem, but perhaps they are talking about the potential
for using an EDFA just to create a large number of entangled particles.

> Myself, I am hoping that longer-key public-key cryptosystems will
> remain unsolved by quantum techniques, at least as long as it takes
> to get rid of governments.  After that, it probably won't matter.  As
> of now, it looks like things will go the way I'd like.

I'm fairly optimistic for a couple of different reasons. First of all,
progress on quantum computers has been very slow and the experts in the
field who have spoken up believe it's unlikely the NSA has a major
breakthrough on this front. Second, I'm skeptical that quantum computers
can even be made to work at all. While D-Wave and others have built
systems that they *believe* are quantum computers and shown some
evidence that they behave as one would expect for such devices, nothing
has yet been demonstrated that could not easily been achieved with a
classical computer, though much of this is due to the small scale of the
devices.

Even if quantum computers can be made to work, one can hope that by then
we'll either have quantum cryptography infrastructure in place (though
the need for physical infrastructure scares me here - maybe guerrilla
wireless quantum crypto?) or have widespread access to practical
quantum-proof public-key crypto. Maybe either the NTRU patent will have
expired or we'll have found alternative cryptosystems that do not
infringe, ala the Lucas sequence alternative to RSA. Of course, the
patent is only a problem in the US and its satellite states anyway.

-- 
Sean Richard Lynch <seanl at literati.org>
http://www.literati.org/~seanl/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131203/681d037b/attachment.sig>

From coderman at gmail.com  Wed Dec  4 14:05:27 2013
From: coderman at gmail.com (coderman)
Date: Wed, 4 Dec 2013 14:05:27 -0800
Subject: NSA tracking cellphone locations worldwide
Message-ID: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>

http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_print.html

"""

NSA tracking cellphone locations worldwide, Snowden documents show

By Barton Gellman and Ashkan Soltani, Wednesday, December 4, 12:18 PM

The National Security Agency is gathering nearly 5 billion records a
day on the whereabouts of cellphones around the world, according to
top-secret documents and interviews with U.S. intelligence officials,
enabling the agency to track the movements of individuals — and map
their relationships — in ways that would have been previously
unimaginable.

The records feed a vast database that stores information about the
locations of at least hundreds of millions of devices, according to
the officials and the documents, which were provided by former NSA
contractorEdward Snowden. New projects created to analyze that data
have provided the intelligence community with what amounts to a mass
surveillance tool.

(Video: How the NSA uses cellphone tracking to find and ‘develop’ targets)

The NSA does not target Americans’ location data by design, but the
agency acquires a substantial amount of information on the whereabouts
of domestic cellphones “incidentally,” a legal term that connotes a
foreseeable but not deliberate result.

One senior collection manager, speaking on condition of anonymity but
with permission from the NSA, said “we are getting vast volumes” of
location data from around the world by tapping into the cables that
connect mobile networks globally and that serve U.S. cellphones as
well as foreign ones. Additionally, data is often collected from the
tens of millions of Americans who travel abroad with their cellphones
every year.

In scale, scope and potential impact on privacy, the efforts to
collect and analyze location data may be unsurpassed among the NSA
surveillance programsthat have been disclosed since June. Analysts can
find cellphones anywhere in the world, retrace their movements and
expose hidden relationships among individuals using them.

(Graphic: How the NSA is tracking people right now)

U.S. officials said the programs that collect and analyze location
data are lawful and intended strictly to develop intelligence about
foreign targets.

Robert Litt, general counsel for the Office of the Director of
National Intelligence, which oversees the NSA, said “there is no
element of the intelligence community that under any authority is
intentionally collecting bulk cellphone location information about
cellphones in the United States.”

The NSA has no reason to suspect that the movements of the
overwhelming majority of cellphone users would be relevant to national
security. Rather, it collects locations in bulk because its most
powerful analytic tools — known collectively as CO-TRAVELER — allow it
to look for unknown associates of known intelligence targets by
tracking people whose movements intersect.

Still, location data, especially when aggregated over time, is widely
regarded among privacy advocates as uniquely sensitive. Sophisticated
mathematical techniques enable NSA analysts to map cellphone owners’
relationships by correlating their patterns of movement over time with
thousands or millions of other phone users who cross their paths.
Cellphones broadcast their locations even when they are not being used
to place a call or send a text.

(Video: Reporter Ashkan Soltani explains NSA collection of cellphone data)

CO-TRAVELER and related tools require the methodical collection and
storage of location data on what amounts to a planetary scale. The
government is tracking people from afar into confidential business
meetings or personal visits to medical facilities, hotel rooms,
private homes and other traditionally protected spaces.

“One of the key components of location data, and why it’s so
sensitive, is that the laws of physics don’t let you keep it private,”
said Chris Soghoian, principal technologist at the American Civil
Liberties Union. People who value their privacy can encrypt their
e-mails and disguise their online identities, but “the only way to
hide your location is to disconnect from our modern communication
system and live in a cave.”

The NSA cannot know in advance which tiny fraction of 1 percent of the
records it may need, so it collects and keeps as many as it can — 27
terabytes, by one account, or more than double the text content of the
Library of Congress’s print collection.

The location programs have brought in such volumes of information,
according to a May 2012 internal NSA briefing, that they are
“outpacing our ability to ingest, process and store” data. In the
ensuing year and a half, the NSA has been transitioning to a
processing system that provided it with greater capacity.

The possibility that the intelligence community has been collecting
location data, particularly of Americans, has long concerned privacy
advocates and some lawmakers. Three Democratic senators — Ron Wyden
(Ore.), Mark Udall (Colo.) and Barbara Mikulski (Md.) — have
introduced an amendment to the 2014 defense spending bill that would
require U.S. intelligence agencies to say whether they have ever
collected or made plans to collect location data for “a large number
of United States persons with no known connection to suspicious
activity.”

NSA Director Keith Alexander disclosed in Senate testimony in October
that the NSA had run a pilot project in 2010 and 2011 to collect
“samples” of U.S. cellphone location data. The data collected were
never available for intelligence analysis purposes, and the project
was discontinued because it had no “operational value,” he said.

Alexander allowed that a broader collection of such data “may be
something that is a future requirement for the country, but it is not
right now.”

The number of Americans whose locations are tracked as part of the
NSA’s collection of data overseas is impossible to determine from the
Snowden documents alone, and senior intelligence officials declined to
offer an estimate.

“It’s awkward for us to try to provide any specific numbers,” one
intelligence official said in a telephone interview. An NSA
spokeswoman who took part in the call cut in to say the agency has no
way to calculate such a figure.

An intelligence lawyer, speaking with his agency’s permission, said
location data are obtained by methods “tuned to be looking outside the
United States,” a formulation he repeated three times. When U.S.
cellphone data are collected, he said, the data are not covered by the
Fourth Amendment, which protects Americans against unreasonable
searches and seizures.

According to top-secret briefing slides, the NSA pulls in location
data around the world from 10 major “sigads,” or signals intelligence
activity designators.

A sigad known as STORMBREW, for example, relies on two unnamed
corporate partners described only as ARTIFICE and WOLFPOINT. According
to an NSA site inventory, the companies administer the NSA’s “physical
systems,” or interception equipment, and “NSA asks nicely for
tasking/updates.”

STORMBREW collects data from 27 telephone links known as OPC/DPC
pairs, which refer to originating and destination points and which
typically transfer traffic from one provider’s internal network to
another’s. That data include cell tower identifiers, which can be used
to locate a phone’s location.

The agency’s access to carriers’ networks appears to be vast.

“Many shared databases, such as those used for roaming, are available
in their complete form to any carrier who requires access to any part
of it,” said Matt Blaze, an associate professor of computer and
information science at the University of Pennsylvania. “This ‘flat’
trust model means that a surprisingly large number of entities have
access to data about customers that they never actually do business
with, and an intelligence agency — hostile or friendly — can get ‘one
stop shopping’ to an expansive range of subscriber data just by
compromising a few carriers.”

Some documents in the Snowden archive suggest that acquisition of U.S.
location data is routine enough to be cited as an example in training
materials. In an October 2012 white paper on analytic techniques, for
example, the NSA’s counterterrorism analysis unit cites two U.S.-based
carriers to illustrate the challenge of correlating the travels of
phone users on different mobile networks. Asked about that, a U.S.
intelligence official said the example was poorly chosen and did not
represent the program’s foreign focus.

The NSA’s capabilities to track location are staggering, based on the
Snowden documents, and indicate that the agency is able to render most
efforts at communications security effectively futile.

Like encryption and anonymity tools online, which are used by
dissidents, journalists and terrorists alike, security-minded behavior
— using disposable cellphones and switching them on only long enough
to make brief calls — marks a user for special scrutiny. CO-TRAVELER
takes note, for example, when a new telephone connects to a cell tower
soon after another nearby device is used for the last time.

Side-by-side security efforts — when nearby devices power off and on
together over time — “assist in determining whether co-travelers are
associated … through behaviorally relevant relationships,” according
to the 24-page white paper, which was developed by the NSA in
partnership with the National Geospatial Agency, the Australian
Signals Directorate and private contractors.

A central feature of each of these tools is that they do not rely on
knowing a particular target in advance, or even suspecting one. They
operate on the full universe of data in the NSA’s FASCIA repository,
which stores trillions of metadata records, of which a large but
unknown fraction include locations.

The most basic analytic tools map the date, time, and location of
cellphones to look for patterns or significant moments of overlap.
Other tools compute speed and trajectory for large numbers of mobile
devices, overlaying the electronic data on transportation maps to
compute the likely travel time and determine which devices might have
intersected.

To solve the problem of undetectable surveillance against CIA officers
stationed overseas, one contractor designed an analytic model that
would carefully record the case officer’s path and look for other
mobile devices in steady proximity.

“Results have not been validated by operational analysts,” the report said.

Julie Tate contributed to this report. Soltani is an independent
security researcher and consultant.
"""




From jya at pipeline.com  Thu Dec  5 05:50:06 2013
From: jya at pipeline.com (John Young)
Date: Thu, 05 Dec 2013 08:50:06 -0500
Subject: Snowden Civil War
Message-ID: <E1VoZIz-0002ZQ-EJ@elasmtp-spurfowl.atl.sa.earthlink.net>

Snowden Civil War:

http://cryptome.org/2013/12/snowden-civil-war.htm





From dan at geer.org  Thu Dec  5 06:13:13 2013
From: dan at geer.org (dan at geer.org)
Date: Thu, 05 Dec 2013 09:13:13 -0500
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: Your message of "Thu, 05 Dec 2013 14:10:31 +0100."
 <CAHWD2rLMrrxqN-DzRyObRFvaGTGvm8yA5cxiGWWM6JHyWLnOCw@mail.gmail.com>
Message-ID: <20131205141313.BC42F2280CB@palinka.tinho.net>


 > The next step is where the federal government declares all state's grounds
 > to be in full ownership of a private company, so that all land is now
 > effectively foreign and no citizen's rights apply to citizens anymore. An
 > American abroad is not an American. That's an official view.


Eleven years before he became the fourth President of the United
States, James Madison said that:

   Perhaps it is a universal truth that the loss of liberty at home
   is to be charged to provisions against danger, real or pretended,
   from abroad.

One wonders how Madison would feel about an interconnected world
where "abroad" has so thoroughly lost its meaning, at least with
respect to Internet-dependent critical infrastructure if not national
frontiers.  My guess is that Madison would decide that the Internet
is, per se, "abroad."


--dan




From jamesdbell8 at yahoo.com  Thu Dec  5 12:09:43 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Thu, 5 Dec 2013 12:09:43 -0800 (PST)
Subject: audiovisual (urls)
In-Reply-To: <87mwkhi1m6.fsf@michiru.Home>
References: <CADhsnxcgFRUg-E7aUDb+RtaQB8swfh5vBTkGkXyGarOD2rE7mg@mail.gmail.com>	<1386041286.39295.YahooMailNeo@web141205.mail.bf1.yahoo.com>	<87txepiv9e.fsf@michiru.Home>	<1386102936.42493.YahooMailNeo@web141203.mail.bf1.yahoo.com>
 <87mwkhi1m6.fsf@michiru.Home>
Message-ID: <1386274183.47441.YahooMailNeo@web141202.mail.bf1.yahoo.com>


________________________________
 From: Sean Lynch <seanl at literati.org>
To: Jim Bell <jamesdbell8 at yahoo.com> 
On Tue, Dec 03 2013, Jim Bell wrote:

>> Okay, thank you for clarifying this matter.  I merely Google-searched
>> for  'EDFA quantum entanglement' and found and cited this paper, and
>> that only because it referred to the problem of trying to amplify
>> quantum signals through an EDFA. 

>No problem. Not having read the actual paper, I'm not even sure what
>they meant by "noise" preventing amplification of quantum signals in an
>EDFA. Quantum states cannot be copied, which seems like a more
>fundamental problem, but perhaps they are talking about the potential
>for using an EDFA just to create a large number of entangled particles.

>> Myself, I am hoping that longer-key public-key cryptosystems will
>> remain unsolved by quantum techniques, at least as long as it takes
>> to get rid of governments.  After that, it probably won't matter.  As
>> of now, it looks like things will go the way I'd like.

>I'm fairly optimistic for a couple of different reasons. First of all,
>progress on quantum computers has been very slow and the experts in the
>field who have spoken up believe it's unlikely the NSA has a major
>breakthrough on this front. Second, I'm skeptical that quantum computers
>can even be made to work at all. While D-Wave and others have built
>systems that they *believe* are quantum computers and shown some
>evidence that they behave as one would expect for such devices, nothing
>has yet been demonstrated that could not easily been achieved with a
>classical computer, though much of this is due to the small scale of the
>devices.

I am limited by the fact that I have only had a couple of classes which touched upon quantum physics (and 35 years ago, to boot), I wonder if there will be some limit to how far these quantum techniques can be used to factor huge numbers. (Speculation warning!)   A 1 centimeter difference in altitude in Earth's gravitational field results in about a 1 part in 10**18 time dilation.  Even if the atoms making up a quantum computer could be maintained  within 1 micron altitude, that would be a time dilation difference of 1 part in 10**22.   Could there be an effect which would allow the factorization of numbers up to, say, 22 digits long, but that would fail if the number was 301 digits long?  (equivalent to 1024 bits.)   Such a computer might be raised into earth orbit to take advantage of micro-gravity effects, but even that might only raise the limit by a few orders of magnitude, say 22+6 = 28.  Someone much more familiar with quantum mechanics
 should be able to shed light on this speculation.
         Jim Bell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3894 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131205/3e1fc05e/attachment.txt>

From l at odewijk.nl  Thu Dec  5 04:52:41 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Thu, 5 Dec 2013 13:52:41 +0100
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
References: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
Message-ID: <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>

Came to my mail client just to post this.

I know my government keeps this data. That's why I thought it's probably an
intelligence community wide secret. And now it turns out it totally is.

This is like the soldiers having marched in our streets since years and
years and our government isn't even worried about it. We're no longer the
actual owner of our country, because another country has had a soldier
passively stalking every person in it. If you do something wrong the
soldier will attack. The laws are not fixed, nor are they coherent per se,
as any three-letter-org may at some point gain "lawfull" access to the
knowledge gathered and blackmail you with it or, worse, manipulate you with
it. Say hello Thought Police.

If it's "just Internet traffic" then many people think "I don't do anything
important on the Internet" (they do, but they don't think so). But now
it's *their
every move*. Without a hint of sarcasm it means they are followed within
their houses, on vacation, doing whatever. My government, my country, my
laws, democratically chosen for my and by my nation (let's suppose ;(  )
state CLEARLY that this is *completely* illegal. There is absolute no legal
basis whereupon the American nation is allowed to break the law on our
ground, on our hardware or even just on our people.

Why is my nation so unaware of this invasion upon our grounds? Why doesn't
it take protective action to the fact that an act of crime or war is taken
upon all it's citizens? How come I can see what those capable of doing
something about it can't? Why isn't there a chilling cold schock running
down their spines when they finally read this sort of articles and realize
they have been partially responsible too?


2013/12/4 coderman <coderman at gmail.com>

>
> http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_print.html
>
> """
>
> NSA tracking cellphone locations worldwide, Snowden documents show
>
> By Barton Gellman and Ashkan Soltani, Wednesday, December 4, 12:18 PM
>
> The National Security Agency is gathering nearly 5 billion records a
> day on the whereabouts of cellphones around the world, according to
> top-secret documents and interviews with U.S. intelligence officials,
> enabling the agency to track the movements of individuals — and map
> their relationships — in ways that would have been previously
> unimaginable.
>
> The records feed a vast database that stores information about the
> locations of at least hundreds of millions of devices, according to
> the officials and the documents, which were provided by former NSA
> contractorEdward Snowden. New projects created to analyze that data
> have provided the intelligence community with what amounts to a mass
> surveillance tool.
>
> (Video: How the NSA uses cellphone tracking to find and ‘develop’ targets)
>
> The NSA does not target Americans’ location data by design, but the
> agency acquires a substantial amount of information on the whereabouts
> of domestic cellphones “incidentally,” a legal term that connotes a
> foreseeable but not deliberate result.
>
> One senior collection manager, speaking on condition of anonymity but
> with permission from the NSA, said “we are getting vast volumes” of
> location data from around the world by tapping into the cables that
> connect mobile networks globally and that serve U.S. cellphones as
> well as foreign ones. Additionally, data is often collected from the
> tens of millions of Americans who travel abroad with their cellphones
> every year.
>
> In scale, scope and potential impact on privacy, the efforts to
> collect and analyze location data may be unsurpassed among the NSA
> surveillance programsthat have been disclosed since June. Analysts can
> find cellphones anywhere in the world, retrace their movements and
> expose hidden relationships among individuals using them.
>
> (Graphic: How the NSA is tracking people right now)
>
> U.S. officials said the programs that collect and analyze location
> data are lawful and intended strictly to develop intelligence about
> foreign targets.
>
> Robert Litt, general counsel for the Office of the Director of
> National Intelligence, which oversees the NSA, said “there is no
> element of the intelligence community that under any authority is
> intentionally collecting bulk cellphone location information about
> cellphones in the United States.”
>
> The NSA has no reason to suspect that the movements of the
> overwhelming majority of cellphone users would be relevant to national
> security. Rather, it collects locations in bulk because its most
> powerful analytic tools — known collectively as CO-TRAVELER — allow it
> to look for unknown associates of known intelligence targets by
> tracking people whose movements intersect.
>
> Still, location data, especially when aggregated over time, is widely
> regarded among privacy advocates as uniquely sensitive. Sophisticated
> mathematical techniques enable NSA analysts to map cellphone owners’
> relationships by correlating their patterns of movement over time with
> thousands or millions of other phone users who cross their paths.
> Cellphones broadcast their locations even when they are not being used
> to place a call or send a text.
>
> (Video: Reporter Ashkan Soltani explains NSA collection of cellphone data)
>
> CO-TRAVELER and related tools require the methodical collection and
> storage of location data on what amounts to a planetary scale. The
> government is tracking people from afar into confidential business
> meetings or personal visits to medical facilities, hotel rooms,
> private homes and other traditionally protected spaces.
>
> “One of the key components of location data, and why it’s so
> sensitive, is that the laws of physics don’t let you keep it private,”
> said Chris Soghoian, principal technologist at the American Civil
> Liberties Union. People who value their privacy can encrypt their
> e-mails and disguise their online identities, but “the only way to
> hide your location is to disconnect from our modern communication
> system and live in a cave.”
>
> The NSA cannot know in advance which tiny fraction of 1 percent of the
> records it may need, so it collects and keeps as many as it can — 27
> terabytes, by one account, or more than double the text content of the
> Library of Congress’s print collection.
>
> The location programs have brought in such volumes of information,
> according to a May 2012 internal NSA briefing, that they are
> “outpacing our ability to ingest, process and store” data. In the
> ensuing year and a half, the NSA has been transitioning to a
> processing system that provided it with greater capacity.
>
> The possibility that the intelligence community has been collecting
> location data, particularly of Americans, has long concerned privacy
> advocates and some lawmakers. Three Democratic senators — Ron Wyden
> (Ore.), Mark Udall (Colo.) and Barbara Mikulski (Md.) — have
> introduced an amendment to the 2014 defense spending bill that would
> require U.S. intelligence agencies to say whether they have ever
> collected or made plans to collect location data for “a large number
> of United States persons with no known connection to suspicious
> activity.”
>
> NSA Director Keith Alexander disclosed in Senate testimony in October
> that the NSA had run a pilot project in 2010 and 2011 to collect
> “samples” of U.S. cellphone location data. The data collected were
> never available for intelligence analysis purposes, and the project
> was discontinued because it had no “operational value,” he said.
>
> Alexander allowed that a broader collection of such data “may be
> something that is a future requirement for the country, but it is not
> right now.”
>
> The number of Americans whose locations are tracked as part of the
> NSA’s collection of data overseas is impossible to determine from the
> Snowden documents alone, and senior intelligence officials declined to
> offer an estimate.
>
> “It’s awkward for us to try to provide any specific numbers,” one
> intelligence official said in a telephone interview. An NSA
> spokeswoman who took part in the call cut in to say the agency has no
> way to calculate such a figure.
>
> An intelligence lawyer, speaking with his agency’s permission, said
> location data are obtained by methods “tuned to be looking outside the
> United States,” a formulation he repeated three times. When U.S.
> cellphone data are collected, he said, the data are not covered by the
> Fourth Amendment, which protects Americans against unreasonable
> searches and seizures.
>
> According to top-secret briefing slides, the NSA pulls in location
> data around the world from 10 major “sigads,” or signals intelligence
> activity designators.
>
> A sigad known as STORMBREW, for example, relies on two unnamed
> corporate partners described only as ARTIFICE and WOLFPOINT. According
> to an NSA site inventory, the companies administer the NSA’s “physical
> systems,” or interception equipment, and “NSA asks nicely for
> tasking/updates.”
>
> STORMBREW collects data from 27 telephone links known as OPC/DPC
> pairs, which refer to originating and destination points and which
> typically transfer traffic from one provider’s internal network to
> another’s. That data include cell tower identifiers, which can be used
> to locate a phone’s location.
>
> The agency’s access to carriers’ networks appears to be vast.
>
> “Many shared databases, such as those used for roaming, are available
> in their complete form to any carrier who requires access to any part
> of it,” said Matt Blaze, an associate professor of computer and
> information science at the University of Pennsylvania. “This ‘flat’
> trust model means that a surprisingly large number of entities have
> access to data about customers that they never actually do business
> with, and an intelligence agency — hostile or friendly — can get ‘one
> stop shopping’ to an expansive range of subscriber data just by
> compromising a few carriers.”
>
> Some documents in the Snowden archive suggest that acquisition of U.S.
> location data is routine enough to be cited as an example in training
> materials. In an October 2012 white paper on analytic techniques, for
> example, the NSA’s counterterrorism analysis unit cites two U.S.-based
> carriers to illustrate the challenge of correlating the travels of
> phone users on different mobile networks. Asked about that, a U.S.
> intelligence official said the example was poorly chosen and did not
> represent the program’s foreign focus.
>
> The NSA’s capabilities to track location are staggering, based on the
> Snowden documents, and indicate that the agency is able to render most
> efforts at communications security effectively futile.
>
> Like encryption and anonymity tools online, which are used by
> dissidents, journalists and terrorists alike, security-minded behavior
> — using disposable cellphones and switching them on only long enough
> to make brief calls — marks a user for special scrutiny. CO-TRAVELER
> takes note, for example, when a new telephone connects to a cell tower
> soon after another nearby device is used for the last time.
>
> Side-by-side security efforts — when nearby devices power off and on
> together over time — “assist in determining whether co-travelers are
> associated … through behaviorally relevant relationships,” according
> to the 24-page white paper, which was developed by the NSA in
> partnership with the National Geospatial Agency, the Australian
> Signals Directorate and private contractors.
>
> A central feature of each of these tools is that they do not rely on
> knowing a particular target in advance, or even suspecting one. They
> operate on the full universe of data in the NSA’s FASCIA repository,
> which stores trillions of metadata records, of which a large but
> unknown fraction include locations.
>
> The most basic analytic tools map the date, time, and location of
> cellphones to look for patterns or significant moments of overlap.
> Other tools compute speed and trajectory for large numbers of mobile
> devices, overlaying the electronic data on transportation maps to
> compute the likely travel time and determine which devices might have
> intersected.
>
> To solve the problem of undetectable surveillance against CIA officers
> stationed overseas, one contractor designed an analytic model that
> would carefully record the case officer’s path and look for other
> mobile devices in steady proximity.
>
> “Results have not been validated by operational analysts,” the report said.
>
> Julie Tate contributed to this report. Soltani is an independent
> security researcher and consultant.
> """
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 14154 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131205/3f20cf89/attachment.txt>

From l at odewijk.nl  Thu Dec  5 05:10:31 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Thu, 5 Dec 2013 14:10:31 +0100
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
References: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
 <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
Message-ID: <CAHWD2rLMrrxqN-DzRyObRFvaGTGvm8yA5cxiGWWM6JHyWLnOCw@mail.gmail.com>

"Rather, it collects locations in bulk because its most powerful analytic
tools — known collectively as CO-TRAVELER — allow it to look for unknown
associates of known intelligence targets by tracking people whose movements
intersect."

You were in the airplane with X so we may now personally inspect all of you.

"When U.S. cellphone data are collected, he said, the data are not covered
by the Fourth Amendment, which protects Americans against unreasonable
searches and seizures."

The next step is where the federal government declares all state's grounds
to be in full ownership of a private company, so that all land is now
effectively foreign and no citizen's rights apply to citizens anymore. An
American abroad is not an American. That's an official view.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 898 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131205/f6efc4f9/attachment.txt>

From juan.g71 at gmail.com  Thu Dec  5 11:51:33 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Thu, 05 Dec 2013 16:51:33 -0300
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
References: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
 <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
Message-ID: <5B3A79266B7E160CB3FE4EA8@F74D39FA044AA309EAEA14B9>



--On Thursday, December 05, 2013 1:52 PM +0100 Lodewijk andré de la porte
<l at odewijk.nl> wrote:

> Why is my nation so unaware of this invasion upon our grounds? Why doesn't
> it take protective action to the fact that an act of crime or war is taken
> upon all it's citizens? 


	Are you an anarchist yet? =)






> 2013/12/4 coderman <coderman at gmail.com>
> 
>> 
>> http://www.washingtonpost.com/world/national-security/nsa-tracking-cellp
>> hone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2
>> -11e3-bc56-c6ca94801fac_print.html
>> 
>> """
>> 
>> NSA tracking cellphone locations worldwide, Snowden documents show
>> 





From juan.g71 at gmail.com  Thu Dec  5 12:09:05 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Thu, 05 Dec 2013 17:09:05 -0300
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: <CAHWD2r+61A7Ti3YFDsLPzDxL+tSTa3Ywuq4t2HEkcZf36jMvDA@mail.gmail.com>
References: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
 <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
 <5B3A79266B7E160CB3FE4EA8@F74D39FA044AA309EAEA14B9>
 <CAHWD2r+61A7Ti3YFDsLPzDxL+tSTa3Ywuq4t2HEkcZf36jMvDA@mail.gmail.com>
Message-ID: <AF360F217C823C8F056FB465@F74D39FA044AA309EAEA14B9>



--On Thursday, December 05, 2013 8:57 PM +0100 Lodewijk andré de la porte
<l at odewijk.nl> wrote:

> 2013/12/5 Juan Garofalo <juan.g71 at gmail.com>
> 
>> Are you an anarchist yet? =)
>> 
> 
> I'm not a anarchist. I'm just the only citizen of Lewisland (LL).
>  

	Heh =)

	http://www.panarchy.org/depuydt/1860.fr.html








From l at odewijk.nl  Thu Dec  5 11:57:19 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Thu, 5 Dec 2013 20:57:19 +0100
Subject: NSA tracking cellphone locations worldwide
In-Reply-To: <5B3A79266B7E160CB3FE4EA8@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1R1CsqMf0mpEV5q-xVn5K+YpdTLOOUC=w_LE0FyvMuz1A@mail.gmail.com>
 <CAHWD2rL1rYx85_b6vDWA38tz_Jx6Oqq-RDdhx6hH1p5TtcG8fQ@mail.gmail.com>
 <5B3A79266B7E160CB3FE4EA8@F74D39FA044AA309EAEA14B9>
Message-ID: <CAHWD2r+61A7Ti3YFDsLPzDxL+tSTa3Ywuq4t2HEkcZf36jMvDA@mail.gmail.com>

2013/12/5 Juan Garofalo <juan.g71 at gmail.com>

> Are you an anarchist yet? =)
>

I'm not a anarchist. I'm just the only citizen of Lewisland (LL).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 539 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131205/eabc241d/attachment.txt>

From lblissett at paranoici.org  Fri Dec  6 11:34:17 2013
From: lblissett at paranoici.org (Luther Blissett)
Date: Fri, 06 Dec 2013 17:34:17 -0200
Subject: [Full-disclosure] Secure whistleblowing feedback / reporting
 systems in the content of compartmented information, endpoint security
 [was: [NSA bitching] [formerly Re: PRISM][]]
In-Reply-To: <CAJVRA1S1TzxPRd5OE3SoesMuTM-oXt8r=6FOoL7Rkw96ELKsoQ@mail.gmail.com>
References: <CAJVRA1S1TzxPRd5OE3SoesMuTM-oXt8r=6FOoL7Rkw96ELKsoQ@mail.gmail.com>
Message-ID: <1386358457.27052.44.camel@tagesuhu-pc>

On Fri, 2013-10-18 at 08:18 -0700, coderman wrote:
> On Fri, Oct 18, 2013 at 4:40 AM,  <dan at geer.org> wrote:
> >...
> > http://geer.tinho.net/geer.uncc.9x13.txt
> 
> 
> an interesting discussion :)
> 
> "This is perhaps our last fundamental tradeoff before the Singularity
> occurs: Do we, as a society, want the comfort and convenience of
> increasingly technologic, invisible digital integration enough to pay
> for those benefits with the liberties that must be given up to be
> protected from the downsides of that integration?" -- dan
> 
> 
> i would argue that there is an alternative in design and architecture,
> mainly those which decentralize and protect end-to-end. however, there
> is a cost attached to these efforts as well, which so far most opt-out
> of paying...
> 
> 
> best regards,
> 

And I would reply that only those who commit to those efforts can see it
more clearly that there are no credit, financing or bitcoin scheme that
can side-step the payment.

Great article dan!
 
-- 
010
001
111




From lblissett at paranoici.org  Fri Dec  6 13:17:29 2013
From: lblissett at paranoici.org (Luther Blissett)
Date: Fri, 06 Dec 2013 19:17:29 -0200
Subject: [Full-disclosure] Secure whistleblowing feedback / reporting
 systems in the content of compartmented information, endpoint security
 [was: [NSA bitching] [formerly Re: PRISM][]]
In-Reply-To: <CAJVRA1S1TzxPRd5OE3SoesMuTM-oXt8r=6FOoL7Rkw96ELKsoQ@mail.gmail.com>
References: <CAJVRA1S1TzxPRd5OE3SoesMuTM-oXt8r=6FOoL7Rkw96ELKsoQ@mail.gmail.com>
Message-ID: <1386364649.27052.64.camel@tagesuhu-pc>

On Fri, 2013-10-18 at 08:18 -0700, coderman wrote:
> On Fri, Oct 18, 2013 at 4:40 AM,  <dan at geer.org> wrote:
> >...
> > http://geer.tinho.net/geer.uncc.9x13.txt
> 
> 
> an interesting discussion :)
> 
> "This is perhaps our last fundamental tradeoff before the Singularity
> occurs: Do we, as a society, want the comfort and convenience of
> increasingly technologic, invisible digital integration enough to pay
> for those benefits with the liberties that must be given up to be
> protected from the downsides of that integration?" -- dan
> 
> 
> i would argue that there is an alternative in design and architecture,
> mainly those which decentralize and protect end-to-end. however, there
> is a cost attached to these efforts as well, which so far most opt-out
> of paying...
> 
> 
> best regards,
> 

And I would reply that only those who commit to those efforts can see it
more clearly that there are no credit, financing or bitcoin scheme that
can side-step the payment.

Great article dan! 

-- 
010
001
111

-- 
010
001
111




From jamesdbell8 at yahoo.com  Fri Dec  6 23:32:54 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Fri, 6 Dec 2013 23:32:54 -0800 (PST)
Subject: infra-org (urls)
In-Reply-To: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
Message-ID: <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>

From: brian carroll <electromagnetize at gmail.com>


'Spooky action' builds a wormhole between 'entangled' quantum particles
http://phys.org/news/2013-12-spooky-action-wormhole-entangled-quantum.html

>note: i must have it all wrong because would it not be possible to
>modify the spin of an entangled pair and have it influence the remote
>particle likewise. and thus, what need of wires or fiber to connect
>events, if a hybrid remote and on-site quatum processing were to take
>place. an ecological or ecosystem context of connectivity in & out of
>various structures via different forms of entanglement. what if 1,000
>circuit boards shared a split particle and were sent to remote areas,
>yet one calculation effected the others and likewise, or perhaps 1,000
>remotely-connected processing functions embedded in 100,000 onsite. in
>other words what if the processor were not discrete nor connected by
>means other than resonance or vibration (perhaps decibels indicates
>this as an acoustic measurement for light even). of course i have no
>idea what i am saying, though as list fool i must speak such nonsense.

"Spooky action" entanglement has been measured to operate at a velocity of at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals transmitted on optical fibers about 20 kilometers apart.)  Unfortunately, there does not appear to be any way to employ this to transmit information.
       Jim Bell


// feeling exhausted? sun magnetic poles may have reversed...

[videos] Sun Reversal of its Magnetic Poles // via hh
http://www.youtube.com/watch?v=z0PbL-ErVas

SUN ABOUT TO FLIP MAGNETIC POLES  (description)
http://www.youtube.com/watch?v=-haqLMAPEE8

MASSIVE Solar Burst./Sun's Pole Reversal.  (esoteric)
http://www.youtube.com/watch?v=lrGtK2W72_o

note: gravity bringing you down more than normal? feeling strange
polarization in your day? perhaps it is the solar magnetic pole
reversal!  as with symptoms of daylight savings time on peoples
routines and schedules, perhaps solar events effect the magnetic
compass within the human body in some fundamental way. anecdote: once
had an MRI, tone-based buzzing with intense Tesla electromagnets that
map out the brain via spinning particles in brain for imaging, so a
particular tone will occur and this shifting of direction within
molecules or by particles themselves can be discerned, via
polarization.  cannot drink caffiene without now having similar
effect, as if a remote satellite locked onto noggin, the molecular
directionality discerned, like wearing an electromagnetic helmet with
invisible wires into the noosphere. perhaps it is only feeling the
wi-fi, though caffeine makes whatever that is apprehendable. now have
a particular method of decaf coffee intake with controlled
micro-caffeine dose as option for a controlled burn into slightly less
out-of-focus tunnel vision. thus when realizing total exhaustion
recently beyond normal levels, and feeling this drag on entire body as
if having walked 1,000 miles tired, it was wondered if that too could
be related to a magnetic reversal impacting nervous system subsystem,
some perhaps more sensitive to these effects. such as the electrically
sensitive who can tell when a new satellite is switched on in orbit,
or for those who tend to short-out streetlights when walking by.
electromagnetism for thought.



// what if dyslexia has something to teach about language structures
// logical reasoning as tuning into truth, its harmonization vs. distonia

Dyslexia's roots traced to bad brain connections
http://www.newscientist.com/article/dn24705-dyslexias-roots-traced-to-bad-brain-connections.html

[quote] The authors claim these findings add to the growing
recognition of dyslexia as a "disconnection syndrome".
"What we're learning from functional imaging is that it's not enough
to talk about brain areas; you're always dealing with a network, and
when you've got a network you've got patterns of connectivity," says
Scott. "So is there some way you could restructure that network that
might be beneficial?" [unquote]



proposed water tap turnoff @ NSA Utah Data Center // via drudgereport
http://www.usnews.com/news/articles/2013/12/03/some-nsa-opponents-want-to-nullify-surveillance-with-state-law



Signalers vs. strong silent types: Sparrows exude personalities during fights
http://phys.org/news/2013-12-strong-silent-sparrows-exude-personalities.html

[quote] "There is a growing realization in the field that factoring in
personality variables will help solve many thorny problems in animal
behavior, such as do animals signal honestly," said Michael Beecher,
co-author and a UW professor of psychology and biology.
In other words, if a bird knew the personality of its opponent, it
would have a better understanding of when to expect an attack..."
[unquote]



Resident Visitor: Laurie Spiegel's Machine Music
The experimental pioneer's groundbreaking work with computers in the
70s and 80s helped lay the foundation for many of today's electronic
noise makers.
http://pitchfork.com/features/articles/9002-laurie-spiegel/



HUMAN BODY RESONANCE FREQUENCIES...  // via helenhall.net
http://listentothisnoise.com/post/59772917907/whats-the-resonant-frequency-of-your-eyes-what

(note the external link to 'Power Standards Lab' titling this as fun
stuff compared to shooting bullets into ballistic gelatin. another
dimension to electronic warfare not yet discussed, how celltowers and
other infrastructure can be used to deliver pain and agony via remote
control)

-- linked from Listen To This Noise...

[audio] Seen but not Heard: contact microphones reveal hidden worlds
http://soundslikenoise.org/2013/08/25/seen-but-not-heard-contact-microphones-reveal-hidden-worlds/


>>  contact_microphones to record   i  n  f  r  a  s  o  u  n  d  .  .  .

Contact microphones (overview)
http://www.recording-microphones.co.uk/Contact-microphones.shtml

[quote] The Contact microphone comes in a variety of guises and is
also known as a transducer, a pickup or a piezo, and is a form of
microphone specifically designed to pick up audio vibrations in solid
objects. Normal studio mics are all built around the principle of
detecting vibrations in the air but Contact mics are different in that
they are designed to pickup surface vibrations. This means that if you
taped one to a wooden board and then stood infront of it and sang. the
chances are it wouldn’t pick anything up. But tap, scrape, or in some
way touch the board and even the softest vibrations will be picked up
by the contact mic. [unquote]

The first rule of CONTACT MIC club // ~practical info; matched preamp option
http://www.musicofsound.co.nz/blog/the-first-rule-of-contact-mic-club

Get Better Sound from Piezo Mics & Pickups
http://suite101.com/a/get-better-sound-from-piezo-mics-and-pickups-a72764

A Comprehensive Guide To Contact Microphones/Piezos
http://enhanced-reality.net/music/a-comprehensive-guide-to-contact-microphonespiezos/

[quote] PVDF don’t have self-resonance because they don’t have a metal
disc, and they’re flexible, so you can attach them to a curved surface
(use epoxy or silicone), and they’re more robust, piezo discs are
rather brittle. [unquote]

ex. rubber coated piezo (missing image link above)
http://www.amazon.com/Ridgeview-Audio-MDK-H-Harp-Pickup/dp/images/B006ZF6W24

[audio] ex. doors, pipes & sinks, hard drives, wind, small servos
http://gamesounddesign.com/Contact-Microphones.html

note: i have a drum trigger for a MIDI connection though the
traditional piezo is held within a plastic case separating it from the
external surface so only a significant force will trigger it. in
contrast, a device such as the Korg CM-200 Clip-On contact microphone
(below) is in more direct contact with the surface, thus more likely
to sense the resonating/vibrating surface, in this case on a music
instrument though presumably could be used elsewise.

Korg CM-200
http://www.korg.com/cm200

note: thus, either with a mixer preamp and-or-else a digital recorder
the contact mic could be used in lieu of an acoustic cardoid/etc
microphone registering signal out of air pressure. this is a piezo
disk transducer, whereas the following is an example of shielded PVDF
options...

ex: Fluoropolymer Piezo Film Tab Contact Microphone (PVDF)
http://contactmicrophones.com/index.html
http://contactmicrophones.com/products-lft.html



Hertzian Tales
Electronic Products, Aesthetic Experience, and Critical Design
Anthony Dunne, The MIT Press  (PDF link. 1999/2005 edition)
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CCwQFjAA&url=http%3A%2F%2Fbscw.wineme.fb5.uni-siegen.de%2Fpub%2Fbscw.cgi%2Fd807744%2F__Hertzian_Tales__Electronic_Products__Aesthetic_Experience__and_Critical_Design.pdf&ei=WdOeUrCBJou0kAeS54CABw&usg=AFQjCNE2DwbM873vh22tPfgTUDLHNOj_lQ&sig2=hXrRdswBAslc5TLQUF7xnA

1 the electronic as post-optimal object 1
2 (in)human factors 21
3 para-functionality: the aesthetics of use 43
4 psychosocial narratives 69
5 real fiction 83
6 hertzian space 101
7 hertzian tales and sublime gadgets 123

conclusion 147
notes 149
bibliography 155
illustration credits 165
index 171


RF-Safe Stop electromagnetic pulse to stop vehicles // via drudgereport
http://www.dailymail.co.uk/sciencetech/article-2518177/End-high-speed-car-chase-Engineers-invent-disables-vehicles-engine-remotely-using-radio-beams.html



--- on organization ---

in earlier days thought the computer OS would help organize life, yet
the filing cabinet approach remains a junk drawer approach scaled up
to the internet worldwide, existing as a global networked junk drawer.
attempts to develop a system have been delayed (AMS) though as part of
this, an organizational approach to offline data (paper and things)
was realized via a consistent, modular approach to storage, such that
everything now has its place and is manageable, contained as it were,
as part of a ecosystem-like relation between stuff.

my interest in organizing information (concepts,ideas) also exists in
environment, feel much better when everything is put away or space
maximized and storable versus cluttered. so space-savings, maximizing
use of space, easy or improved maintenance, easier to find, etc.

{my computer just crashed again due to a hack from cypherpunks thus
lost paragraph written} though this particular approach to storage via
Really Useful Boxes has transformed my life via organizing what would
otherwise be in chaos, allowing stackable and nestable storage (boxes
in boxes, boxes made for certain dimensional items, such as CDs or
file folders) and also the unique foldable crates/containers that
expand/contract as needed. also, tamper proof pins available. others
may prefer other containers or other brands or approaches, though in
my situation the Really Useful Boxes solved the organization and
management situation and allow continual tweaking over time.
manufacturer website...

Really Useful Boxes Inc.
http://www.reallyusefulproducts.co.uk/usa/index.php

now if only storage could be connected with barcode inventories or
bluetooth stickers and managed via the OS as part of an ecosystem
approach (i.e. Asperger Management System). must note: a favorite
organizational, stuff management & transport device is the gigantic
Ikea foldable bags. they can help carry a large box or vast clothes,
gear, or supplies and fold down to a small format that fits in a
backpack or bag. excellent if needing to move lots of stuff fast.

^(quasi: offline organization influences approach to computer, online)

other than this, right now, in analog mode with index cards and
post-it notes instead of digital tools, still in paper realm of
organization day to day, the role of the paper shredder still seems
vital to any organizational approach, present to future, say managing
scanned documents that are stored digitally and then either filed or
shredded, given priority. such systems in contrast to doing nothing,
tendency to have data collect as if layers of new dust, and paper
multiplies week by week until unmanageable chaos, unless managing it.
figuring it out via a systematic approach. and that is where
offline/computer/online are mismatched, a huge gap between chaos of
offline filing cabinet and computer and online cloud junk drawers and
data model that has no empirical basis for knowledge or information.
no 'shared truth' that is a relational structure. instead, urls and
search. hunt and peck. where's that copy of the hospital bill again?
maybe the great synchrony is the gap that requires and relies upon the
junk drawer and hoarding approach online, at OS level, and offline,
due to the gap with ideas, the loss of concepts altogether within
computing: "tools for thinking" absent as a worldview.


--- on heartbreak and hope ---

e-ink has been for me the great potential for a more 'idea-based'
approach to display, such that larger format interfaces such as
calendars or maps could feasibly become updateable and readable in a
non-projected-light or blaring screen approach that scorches the
eyeballs or loses readability in the sun or forces extreme fatigue in
high-contrast viewing (screens when read at night in low light or for
long periods of time, hours to days and weeks of interaction).

an upgraded version of the Kindle DX was in my estimate the best
change of finally having a tool or platform for sharing ideas, beyond
the failure zone of email lists and blogs and social media sites, that
'ideas' and conceptualization both in a realm of scholarship and
thinking, as this relates to discussion and feedback and debate, could
be opened up by a tool that meets this realm of *advanced literacy* --
and yet instead, when the next-gen Paperwhite Kindle was announced,
the large format DX had no such update and then was said by some
Amazon representative to not be in further development, thus the only
viable PDF reader at size of actual documents was left in an unlit
condition, eventually removed from their website.

this basically killed off my remaining hope in technological
innovation because it forced any such publishing platform that could
develop for ideas into a constricted zone of haikus only and penguin
classics small-book formats, great for reading on a bus, bad for
complex ideas and diagrams and visual and written communication
combined, at a readable type size where formatting does not need to be
pinched & zoomed repeatedly to move through information, and thus
issues of formatting as it relates to standards, the web deteriorated
into various formatting approaches, canned 'big box' solutions,
monoculture, deafening sameness that adds up to nothing more than the
part.

when i considered the Kindle DX as a platform it seems ideal for
fishing and topo maps, for documents yet also calendar like
scheduling, day planning, etc. though in years of thinking about it
(and never yet using the device), one day it dawned on me the missing
functionality was the very attribute that originally seemed the
greatest feature: free 3G connectivity to Wikipedia.

this is one of those issues for a person like myself who grew up
without an encyclopedia within the home, yet had a yearning
fascination with information yet no access. as it remains today in
many ways, sans cellphone, though having ready access to an online
reference work could then open up questioning and the imagination to
further considerations instead of stopping or limiting next steps in
thinking.  this is equivalent to the advice 'if you do know what a
word means look it up in the dictionary' as a life practice, to
improving literacy, yet at the larger connected realm of ideas in
their expanded explanation and description, integral
conceptualization.

and thus in reverse, the idea arose that wouldn't it be ideal if the
Kindle DX was a _writing platform as well as just reading. not simply
writing a computer, but also, at the e-ink device via touchscreen or
other interface (handwriting, diagramming).

a related concept i have described as 'fractal reading/writing' is in
some ways connected to this ability to write in categories versus
long-strings of conventional descriptive language, more like
programming or code for structures of concepts, as if molecular
entities. going into a concept, not just across it, via language.
modeling the ideas, concepts, structural 'forms', where scaffolding
may exist as substructures hidden or not in given views (xml, tags,
etc)

the realization then that if every Kindle shipped with wiki software
that would allow people to write these structures and link them
together in a new public zone of the internet that is based upon ideas
and concepts and their organization. a public realm like cafe society
where debates and discussions could occur, conceptualization beyond
boundaries of websites or separated blogs, and into the structures
themselves, that would move from individual POVs in relativistic
frames, grounded or not, into a larger empirical structure, if
mediated this way, organized, managed, maintained, say by public
discourse, debate, challenging of hypotheses.

this, tools for thinking and tools for developing literacy, to battle
the engrained ignorance that one-way media and vested opinions
together establish, especially when separated and left unchallenged or
untested beyond a comfortable isolation. what if tools could
reestablish or allow a public zone or square or environment where
today none actually exists. and what if it is wiki and e-readers and
those who use these for scholarship and exchanging ideas, and thus
various platforms and vendors could exist and participate, allow
access and interface, yet also it would involve those with knowledge
of particular domains to develop and model them, and potentially
transform existing conceptions of what a field or discipline actually
is, in contrast to the outdated or detached academic models that may
limit what is approved.

being someone who is intrigued by innovative technological tools with
purpose, it was completely devastating when Amazon dropped support for
the larger format DX. i lost faith in Bezos vision because it at once
manages a future of books while removing the larger purpose of ideas
and concept development they involve, making it a read-only scenario
with Kindles versus a read-and-write platform for those developing
ideas, the people who are creating the documents, so they can review
their own work at scale, away from the PC screen and read others ideas
likewise, beyond its domination over context and interpretation, via
distraction and requirement of multitasking with an OS or other device
with demands.

thus the [concept] + [concept] = [concept] / [concept] approach that
wikis allow could be a new way of 'writing' that is non-linear and
fractal, going into other networked data structures or particular
versions, to create various models of ideas and concepts and new
organizations or a worldview, new interface to online information that
could be developed that is integrated into a single model, and data
could be attached to this, instead of having individual branded
websites reinventing the wheel, they could be data structures instead
with basic facts and details. certainly would deal with information
anxiety issues at every level, from finding out info in a Wolfram-like
computational approach, to the phone-book aspect of just wanting the
facts without the 1mb download of advertising banner ads and all the
tracking data to locate an address, etc. and then it could be
visualized atop that via the various approaches, instead of tied down
into static rendered css/xml sites as UI/display.

there is no reason this wiki-approach could not exist on tablets and
cellphones likewise, (in the sense of 'tools for thinking') though it
is this issue related to readability adn those who are writers or
thinkers or scholars or communicator/conveyors, debaters of ideas,
etc, that in reading or considering ideas, the issues of the screen
and its biasing does influence what is read, how it is read, and
within what parameters (in browser, often with animations running or
OS notifications, or various errors) versus a device purpose-made for
easy readability and reading, the pleasure of textual communication,
even into embedded visuals/diagrams, versus the hassle that is email
or all the formatted bureaucracy blogs require to upkeep while
limiting reference or url-rot or whatever. versus having data stored
as documents in a library within a device -or- accessible as a
structure, as with a wiki-structure of networked data models, that
could become a new realm of the internet, expanding further than
wikipedia yet still accessible. another variant like gopher or mailing
lists, yet more permanent, like earlier days of (lynx-like) Yahoo
categorization yet public, developed as areas of integrated knowledge
and areas of debate and discussion, not limited to the outdated
worldviews held within and requiring censorship to control and
discourage feedback, within institutions. thus, the opportunity for
Galilean/Copernicun remodeling and working-through such conditions
rather than avoiding or voiding such thinking, makign the internet
read-only for ideas in terms of public discourse, debate, ideas,
"books", knowledge, "culture", thinking, etc. i.e. beyond
overly-limiting corporate or institutional or private control over
shared reality.

so Amazon dropped out, and Sony went conceptual and introduced a
fascinating upgrade to their e-ink future with a prototype now
deploying for testing in Japan. see the video:

13.3-inch Sony tablet // the future...
http://news.cnet.com/8301-17938_105-57585367-1/13.3-inch-sony-tablet-is-like-etch-a-sketch-on-steroids/

so this is not just an e-reader, it is described as a 'digital
notepad' and 'digital paper', perhaps tending toward the concept of a
clipboard functionality for this kind of device, where it could be
used for formwork, charting, census, notes and writing, scheduling,
etc. and likely would be much more usable than a tablet (including
large sized) due to weight, battery life, readability, and better
functionality with dedicated or programmable task buttons that are not
needing to relate to MP3 and videos, other non-relevant apps or
adds-on (everything!)

it is also mentioned is focused on Universities, so it has an inherent
educational purpose, (potentially: tool for thinking) and is currently
in trials in Japan from what i last read. and a price of approximately
1k USD was recently mentioned, which is also interesting, in that it
makes it impracticle for most citizens unless a niche or supported
project.

this must have freaked out Amazon and reawoken their Kindle DX program
because the device has since reappeared on their website, and for a
heavily discounted price (169 USD, when previously in the 379 USD
range). it was a closeout special before, yet reintroduced, it is a
reactivation of a forfeited category, something that was said
officially a dead-end, and to me was a betrayal of ideas and the
Kindle as a publishing platform, thus the heartbreak that the soul of
books have become only about the money made from them, not the
continuance of ideas they contain and culture they develop and
sustain. yet, along with quadrocopters, suddenly Amazon and Bezos are
back in the realm of critical relevance in this same context by what
is potentially a vital reversal, hopefully and likely indicating a
renewed interest in the large-format e-ink reader as future data
management, organization, communication devices.

it was difficult for a person like me, heavily vested in strange ideas
requiring a platform for their public exchange, to be removed as a
possibility. it was preface to extinction for the very relevance of
thought within networked media, to have the literacy device disappear,
taken over by more jukeboxes with electronic money-slots required for
each & every interaction.

it is potentially heartening that Amazon is responding to innovation
from Sony, realizes the potential and need, and will bring
paperwhite-like illumination to a large format e-reader, a next
generation Kindle DX, hopefully others like Sony will also.

presumably there was not a viable enough market or need or the timing
was not right for such a next stage, in terms of corporate-interest,
before now. yet i think it always existing though is not voiced, yet
it is the vital core of the culture and internet that would use such
devices, especially those who think and organize and share and debate
their thoughts.

perhaps a next generation larger format DX device would have been too
expensive with older e-ink screens, until the Sony approach. and thus
would not sell enough to justify the investment needed. whatever the
case, the latest ongoing pricepoint for the existing DX indicates a
next generation Kindle DX could be in the works if not using the same
E Ink Mobius screen as the Sony digital notepad, potentially or
eventually. thus it would not suprise if the next DX is somewhere
between the existing and last launched pricepoint, instead of further
towards the 1K USD that is breaking new ground for a prefered display
for written, diagrammatic, textual, modeled information, organization,
and management that tends more towards the library than file cabinet
turning into a data junk drawer approach.
likewise, another such device for construction documents....
(logistics, networked data management)

PocketBook CAD Reader  // Fina screen
http://archinect.com/news/article/87978707/e-ink-introduces-display-and-new-pocketbook-tablet-for-use-on-the-construction-site

[video] Pocketbook CAD Reader Debuts in New Commercial
http://goodereader.com/blog/electronic-readers/pocketbook-cad-reader-debuts-in-new-commercial

note on kindle dx, autocad device, sony large-format!!, killer-app
missing: wikis. new www space (structured info) could be created using
it and other software as shared web-platform. ii.e. writing as wiki,
wiki as approach to writing, not serial strings, deep structural
concepts.
[concept] [concept] + [concept] diagrammatic approach to communication
(fractal r/w)


{educational fair-use of copyright, 2013}

Caligula, Monty Python and the Holy Grail, Spartacus
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 31427 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131206/dc8a213f/attachment.txt>

From electromagnetize at gmail.com  Fri Dec  6 22:11:43 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 7 Dec 2013 00:11:43 -0600
Subject: infra-org (urls)
Message-ID: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>

'Spooky action' builds a wormhole between 'entangled' quantum particles
http://phys.org/news/2013-12-spooky-action-wormhole-entangled-quantum.html

note: i must have it all wrong because would it not be possible to
modify the spin of an entangled pair and have it influence the remote
particle likewise. and thus, what need of wires or fiber to connect
events, if a hybrid remote and on-site quatum processing were to take
place. an ecological or ecosystem context of connectivity in & out of
various structures via different forms of entanglement. what if 1,000
circuit boards shared a split particle and were sent to remote areas,
yet one calculation effected the others and likewise, or perhaps 1,000
remotely-connected processing functions embedded in 100,000 onsite. in
other words what if the processor were not discrete nor connected by
means other than resonance or vibration (perhaps decibels indicates
this as an acoustic measurement for light even). of course i have no
idea what i am saying, though as list fool i must speak such nonsense.



// feeling exhausted? sun magnetic poles may have reversed...

[videos] Sun Reversal of its Magnetic Poles // via hh
http://www.youtube.com/watch?v=z0PbL-ErVas

SUN ABOUT TO FLIP MAGNETIC POLES  (description)
http://www.youtube.com/watch?v=-haqLMAPEE8

MASSIVE Solar Burst./Sun's Pole Reversal.  (esoteric)
http://www.youtube.com/watch?v=lrGtK2W72_o

note: gravity bringing you down more than normal? feeling strange
polarization in your day? perhaps it is the solar magnetic pole
reversal!  as with symptoms of daylight savings time on peoples
routines and schedules, perhaps solar events effect the magnetic
compass within the human body in some fundamental way. anecdote: once
had an MRI, tone-based buzzing with intense Tesla electromagnets that
map out the brain via spinning particles in brain for imaging, so a
particular tone will occur and this shifting of direction within
molecules or by particles themselves can be discerned, via
polarization.  cannot drink caffiene without now having similar
effect, as if a remote satellite locked onto noggin, the molecular
directionality discerned, like wearing an electromagnetic helmet with
invisible wires into the noosphere. perhaps it is only feeling the
wi-fi, though caffeine makes whatever that is apprehendable. now have
a particular method of decaf coffee intake with controlled
micro-caffeine dose as option for a controlled burn into slightly less
out-of-focus tunnel vision. thus when realizing total exhaustion
recently beyond normal levels, and feeling this drag on entire body as
if having walked 1,000 miles tired, it was wondered if that too could
be related to a magnetic reversal impacting nervous system subsystem,
some perhaps more sensitive to these effects. such as the electrically
sensitive who can tell when a new satellite is switched on in orbit,
or for those who tend to short-out streetlights when walking by.
electromagnetism for thought.



// what if dyslexia has something to teach about language structures
// logical reasoning as tuning into truth, its harmonization vs. distonia

Dyslexia's roots traced to bad brain connections
http://www.newscientist.com/article/dn24705-dyslexias-roots-traced-to-bad-brain-connections.html

[quote] The authors claim these findings add to the growing
recognition of dyslexia as a "disconnection syndrome".
"What we're learning from functional imaging is that it's not enough
to talk about brain areas; you're always dealing with a network, and
when you've got a network you've got patterns of connectivity," says
Scott. "So is there some way you could restructure that network that
might be beneficial?" [unquote]



proposed water tap turnoff @ NSA Utah Data Center // via drudgereport
http://www.usnews.com/news/articles/2013/12/03/some-nsa-opponents-want-to-nullify-surveillance-with-state-law



Signalers vs. strong silent types: Sparrows exude personalities during fights
http://phys.org/news/2013-12-strong-silent-sparrows-exude-personalities.html

[quote] "There is a growing realization in the field that factoring in
personality variables will help solve many thorny problems in animal
behavior, such as do animals signal honestly," said Michael Beecher,
co-author and a UW professor of psychology and biology.
In other words, if a bird knew the personality of its opponent, it
would have a better understanding of when to expect an attack..."
[unquote]



Resident Visitor: Laurie Spiegel's Machine Music
The experimental pioneer's groundbreaking work with computers in the
70s and 80s helped lay the foundation for many of today's electronic
noise makers.
http://pitchfork.com/features/articles/9002-laurie-spiegel/



HUMAN BODY RESONANCE FREQUENCIES...  // via helenhall.net
http://listentothisnoise.com/post/59772917907/whats-the-resonant-frequency-of-your-eyes-what

(note the external link to 'Power Standards Lab' titling this as fun
stuff compared to shooting bullets into ballistic gelatin. another
dimension to electronic warfare not yet discussed, how celltowers and
other infrastructure can be used to deliver pain and agony via remote
control)

-- linked from Listen To This Noise...

[audio] Seen but not Heard: contact microphones reveal hidden worlds
http://soundslikenoise.org/2013/08/25/seen-but-not-heard-contact-microphones-reveal-hidden-worlds/


>>  contact_microphones to record   i  n  f  r  a  s  o  u  n  d  .  .  .

Contact microphones (overview)
http://www.recording-microphones.co.uk/Contact-microphones.shtml

[quote] The Contact microphone comes in a variety of guises and is
also known as a transducer, a pickup or a piezo, and is a form of
microphone specifically designed to pick up audio vibrations in solid
objects. Normal studio mics are all built around the principle of
detecting vibrations in the air but Contact mics are different in that
they are designed to pickup surface vibrations. This means that if you
taped one to a wooden board and then stood infront of it and sang. the
chances are it wouldn’t pick anything up. But tap, scrape, or in some
way touch the board and even the softest vibrations will be picked up
by the contact mic. [unquote]

The first rule of CONTACT MIC club // ~practical info; matched preamp option
http://www.musicofsound.co.nz/blog/the-first-rule-of-contact-mic-club

Get Better Sound from Piezo Mics & Pickups
http://suite101.com/a/get-better-sound-from-piezo-mics-and-pickups-a72764

A Comprehensive Guide To Contact Microphones/Piezos
http://enhanced-reality.net/music/a-comprehensive-guide-to-contact-microphonespiezos/

[quote] PVDF don’t have self-resonance because they don’t have a metal
disc, and they’re flexible, so you can attach them to a curved surface
(use epoxy or silicone), and they’re more robust, piezo discs are
rather brittle. [unquote]

ex. rubber coated piezo (missing image link above)
http://www.amazon.com/Ridgeview-Audio-MDK-H-Harp-Pickup/dp/images/B006ZF6W24

[audio] ex. doors, pipes & sinks, hard drives, wind, small servos
http://gamesounddesign.com/Contact-Microphones.html

note: i have a drum trigger for a MIDI connection though the
traditional piezo is held within a plastic case separating it from the
external surface so only a significant force will trigger it. in
contrast, a device such as the Korg CM-200 Clip-On contact microphone
(below) is in more direct contact with the surface, thus more likely
to sense the resonating/vibrating surface, in this case on a music
instrument though presumably could be used elsewise.

Korg CM-200
http://www.korg.com/cm200

note: thus, either with a mixer preamp and-or-else a digital recorder
the contact mic could be used in lieu of an acoustic cardoid/etc
microphone registering signal out of air pressure. this is a piezo
disk transducer, whereas the following is an example of shielded PVDF
options...

ex: Fluoropolymer Piezo Film Tab Contact Microphone (PVDF)
http://contactmicrophones.com/index.html
http://contactmicrophones.com/products-lft.html



Hertzian Tales
Electronic Products, Aesthetic Experience, and Critical Design
Anthony Dunne, The MIT Press  (PDF link. 1999/2005 edition)
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CCwQFjAA&url=http%3A%2F%2Fbscw.wineme.fb5.uni-siegen.de%2Fpub%2Fbscw.cgi%2Fd807744%2F__Hertzian_Tales__Electronic_Products__Aesthetic_Experience__and_Critical_Design.pdf&ei=WdOeUrCBJou0kAeS54CABw&usg=AFQjCNE2DwbM873vh22tPfgTUDLHNOj_lQ&sig2=hXrRdswBAslc5TLQUF7xnA

1 the electronic as post-optimal object 1
2 (in)human factors 21
3 para-functionality: the aesthetics of use 43
4 psychosocial narratives 69
5 real fiction 83
6 hertzian space 101
7 hertzian tales and sublime gadgets 123

conclusion 147
notes 149
bibliography 155
illustration credits 165
index 171


RF-Safe Stop electromagnetic pulse to stop vehicles // via drudgereport
http://www.dailymail.co.uk/sciencetech/article-2518177/End-high-speed-car-chase-Engineers-invent-disables-vehicles-engine-remotely-using-radio-beams.html



--- on organization ---

in earlier days thought the computer OS would help organize life, yet
the filing cabinet approach remains a junk drawer approach scaled up
to the internet worldwide, existing as a global networked junk drawer.
attempts to develop a system have been delayed (AMS) though as part of
this, an organizational approach to offline data (paper and things)
was realized via a consistent, modular approach to storage, such that
everything now has its place and is manageable, contained as it were,
as part of a ecosystem-like relation between stuff.

my interest in organizing information (concepts,ideas) also exists in
environment, feel much better when everything is put away or space
maximized and storable versus cluttered. so space-savings, maximizing
use of space, easy or improved maintenance, easier to find, etc.

{my computer just crashed again due to a hack from cypherpunks thus
lost paragraph written} though this particular approach to storage via
Really Useful Boxes has transformed my life via organizing what would
otherwise be in chaos, allowing stackable and nestable storage (boxes
in boxes, boxes made for certain dimensional items, such as CDs or
file folders) and also the unique foldable crates/containers that
expand/contract as needed. also, tamper proof pins available. others
may prefer other containers or other brands or approaches, though in
my situation the Really Useful Boxes solved the organization and
management situation and allow continual tweaking over time.
manufacturer website...

Really Useful Boxes Inc.
http://www.reallyusefulproducts.co.uk/usa/index.php

now if only storage could be connected with barcode inventories or
bluetooth stickers and managed via the OS as part of an ecosystem
approach (i.e. Asperger Management System). must note: a favorite
organizational, stuff management & transport device is the gigantic
Ikea foldable bags. they can help carry a large box or vast clothes,
gear, or supplies and fold down to a small format that fits in a
backpack or bag. excellent if needing to move lots of stuff fast.

^(quasi: offline organization influences approach to computer, online)

other than this, right now, in analog mode with index cards and
post-it notes instead of digital tools, still in paper realm of
organization day to day, the role of the paper shredder still seems
vital to any organizational approach, present to future, say managing
scanned documents that are stored digitally and then either filed or
shredded, given priority. such systems in contrast to doing nothing,
tendency to have data collect as if layers of new dust, and paper
multiplies week by week until unmanageable chaos, unless managing it.
figuring it out via a systematic approach. and that is where
offline/computer/online are mismatched, a huge gap between chaos of
offline filing cabinet and computer and online cloud junk drawers and
data model that has no empirical basis for knowledge or information.
no 'shared truth' that is a relational structure. instead, urls and
search. hunt and peck. where's that copy of the hospital bill again?
maybe the great synchrony is the gap that requires and relies upon the
junk drawer and hoarding approach online, at OS level, and offline,
due to the gap with ideas, the loss of concepts altogether within
computing: "tools for thinking" absent as a worldview.


--- on heartbreak and hope ---

e-ink has been for me the great potential for a more 'idea-based'
approach to display, such that larger format interfaces such as
calendars or maps could feasibly become updateable and readable in a
non-projected-light or blaring screen approach that scorches the
eyeballs or loses readability in the sun or forces extreme fatigue in
high-contrast viewing (screens when read at night in low light or for
long periods of time, hours to days and weeks of interaction).

an upgraded version of the Kindle DX was in my estimate the best
change of finally having a tool or platform for sharing ideas, beyond
the failure zone of email lists and blogs and social media sites, that
'ideas' and conceptualization both in a realm of scholarship and
thinking, as this relates to discussion and feedback and debate, could
be opened up by a tool that meets this realm of *advanced literacy* --
and yet instead, when the next-gen Paperwhite Kindle was announced,
the large format DX had no such update and then was said by some
Amazon representative to not be in further development, thus the only
viable PDF reader at size of actual documents was left in an unlit
condition, eventually removed from their website.

this basically killed off my remaining hope in technological
innovation because it forced any such publishing platform that could
develop for ideas into a constricted zone of haikus only and penguin
classics small-book formats, great for reading on a bus, bad for
complex ideas and diagrams and visual and written communication
combined, at a readable type size where formatting does not need to be
pinched & zoomed repeatedly to move through information, and thus
issues of formatting as it relates to standards, the web deteriorated
into various formatting approaches, canned 'big box' solutions,
monoculture, deafening sameness that adds up to nothing more than the
part.

when i considered the Kindle DX as a platform it seems ideal for
fishing and topo maps, for documents yet also calendar like
scheduling, day planning, etc. though in years of thinking about it
(and never yet using the device), one day it dawned on me the missing
functionality was the very attribute that originally seemed the
greatest feature: free 3G connectivity to Wikipedia.

this is one of those issues for a person like myself who grew up
without an encyclopedia within the home, yet had a yearning
fascination with information yet no access. as it remains today in
many ways, sans cellphone, though having ready access to an online
reference work could then open up questioning and the imagination to
further considerations instead of stopping or limiting next steps in
thinking.  this is equivalent to the advice 'if you do know what a
word means look it up in the dictionary' as a life practice, to
improving literacy, yet at the larger connected realm of ideas in
their expanded explanation and description, integral
conceptualization.

and thus in reverse, the idea arose that wouldn't it be ideal if the
Kindle DX was a _writing platform as well as just reading. not simply
writing a computer, but also, at the e-ink device via touchscreen or
other interface (handwriting, diagramming).

a related concept i have described as 'fractal reading/writing' is in
some ways connected to this ability to write in categories versus
long-strings of conventional descriptive language, more like
programming or code for structures of concepts, as if molecular
entities. going into a concept, not just across it, via language.
modeling the ideas, concepts, structural 'forms', where scaffolding
may exist as substructures hidden or not in given views (xml, tags,
etc)

the realization then that if every Kindle shipped with wiki software
that would allow people to write these structures and link them
together in a new public zone of the internet that is based upon ideas
and concepts and their organization. a public realm like cafe society
where debates and discussions could occur, conceptualization beyond
boundaries of websites or separated blogs, and into the structures
themselves, that would move from individual POVs in relativistic
frames, grounded or not, into a larger empirical structure, if
mediated this way, organized, managed, maintained, say by public
discourse, debate, challenging of hypotheses.

this, tools for thinking and tools for developing literacy, to battle
the engrained ignorance that one-way media and vested opinions
together establish, especially when separated and left unchallenged or
untested beyond a comfortable isolation. what if tools could
reestablish or allow a public zone or square or environment where
today none actually exists. and what if it is wiki and e-readers and
those who use these for scholarship and exchanging ideas, and thus
various platforms and vendors could exist and participate, allow
access and interface, yet also it would involve those with knowledge
of particular domains to develop and model them, and potentially
transform existing conceptions of what a field or discipline actually
is, in contrast to the outdated or detached academic models that may
limit what is approved.

being someone who is intrigued by innovative technological tools with
purpose, it was completely devastating when Amazon dropped support for
the larger format DX. i lost faith in Bezos vision because it at once
manages a future of books while removing the larger purpose of ideas
and concept development they involve, making it a read-only scenario
with Kindles versus a read-and-write platform for those developing
ideas, the people who are creating the documents, so they can review
their own work at scale, away from the PC screen and read others ideas
likewise, beyond its domination over context and interpretation, via
distraction and requirement of multitasking with an OS or other device
with demands.

thus the [concept] + [concept] = [concept] / [concept] approach that
wikis allow could be a new way of 'writing' that is non-linear and
fractal, going into other networked data structures or particular
versions, to create various models of ideas and concepts and new
organizations or a worldview, new interface to online information that
could be developed that is integrated into a single model, and data
could be attached to this, instead of having individual branded
websites reinventing the wheel, they could be data structures instead
with basic facts and details. certainly would deal with information
anxiety issues at every level, from finding out info in a Wolfram-like
computational approach, to the phone-book aspect of just wanting the
facts without the 1mb download of advertising banner ads and all the
tracking data to locate an address, etc. and then it could be
visualized atop that via the various approaches, instead of tied down
into static rendered css/xml sites as UI/display.

there is no reason this wiki-approach could not exist on tablets and
cellphones likewise, (in the sense of 'tools for thinking') though it
is this issue related to readability adn those who are writers or
thinkers or scholars or communicator/conveyors, debaters of ideas,
etc, that in reading or considering ideas, the issues of the screen
and its biasing does influence what is read, how it is read, and
within what parameters (in browser, often with animations running or
OS notifications, or various errors) versus a device purpose-made for
easy readability and reading, the pleasure of textual communication,
even into embedded visuals/diagrams, versus the hassle that is email
or all the formatted bureaucracy blogs require to upkeep while
limiting reference or url-rot or whatever. versus having data stored
as documents in a library within a device -or- accessible as a
structure, as with a wiki-structure of networked data models, that
could become a new realm of the internet, expanding further than
wikipedia yet still accessible. another variant like gopher or mailing
lists, yet more permanent, like earlier days of (lynx-like) Yahoo
categorization yet public, developed as areas of integrated knowledge
and areas of debate and discussion, not limited to the outdated
worldviews held within and requiring censorship to control and
discourage feedback, within institutions. thus, the opportunity for
Galilean/Copernicun remodeling and working-through such conditions
rather than avoiding or voiding such thinking, makign the internet
read-only for ideas in terms of public discourse, debate, ideas,
"books", knowledge, "culture", thinking, etc. i.e. beyond
overly-limiting corporate or institutional or private control over
shared reality.

so Amazon dropped out, and Sony went conceptual and introduced a
fascinating upgrade to their e-ink future with a prototype now
deploying for testing in Japan. see the video:

13.3-inch Sony tablet // the future...
http://news.cnet.com/8301-17938_105-57585367-1/13.3-inch-sony-tablet-is-like-etch-a-sketch-on-steroids/

so this is not just an e-reader, it is described as a 'digital
notepad' and 'digital paper', perhaps tending toward the concept of a
clipboard functionality for this kind of device, where it could be
used for formwork, charting, census, notes and writing, scheduling,
etc. and likely would be much more usable than a tablet (including
large sized) due to weight, battery life, readability, and better
functionality with dedicated or programmable task buttons that are not
needing to relate to MP3 and videos, other non-relevant apps or
adds-on (everything!)

it is also mentioned is focused on Universities, so it has an inherent
educational purpose, (potentially: tool for thinking) and is currently
in trials in Japan from what i last read. and a price of approximately
1k USD was recently mentioned, which is also interesting, in that it
makes it impracticle for most citizens unless a niche or supported
project.

this must have freaked out Amazon and reawoken their Kindle DX program
because the device has since reappeared on their website, and for a
heavily discounted price (169 USD, when previously in the 379 USD
range). it was a closeout special before, yet reintroduced, it is a
reactivation of a forfeited category, something that was said
officially a dead-end, and to me was a betrayal of ideas and the
Kindle as a publishing platform, thus the heartbreak that the soul of
books have become only about the money made from them, not the
continuance of ideas they contain and culture they develop and
sustain. yet, along with quadrocopters, suddenly Amazon and Bezos are
back in the realm of critical relevance in this same context by what
is potentially a vital reversal, hopefully and likely indicating a
renewed interest in the large-format e-ink reader as future data
management, organization, communication devices.

it was difficult for a person like me, heavily vested in strange ideas
requiring a platform for their public exchange, to be removed as a
possibility. it was preface to extinction for the very relevance of
thought within networked media, to have the literacy device disappear,
taken over by more jukeboxes with electronic money-slots required for
each & every interaction.

it is potentially heartening that Amazon is responding to innovation
from Sony, realizes the potential and need, and will bring
paperwhite-like illumination to a large format e-reader, a next
generation Kindle DX, hopefully others like Sony will also.

presumably there was not a viable enough market or need or the timing
was not right for such a next stage, in terms of corporate-interest,
before now. yet i think it always existing though is not voiced, yet
it is the vital core of the culture and internet that would use such
devices, especially those who think and organize and share and debate
their thoughts.

 perhaps a next generation larger format DX device would have been too
expensive with older e-ink screens, until the Sony approach. and thus
would not sell enough to justify the investment needed. whatever the
case, the latest ongoing pricepoint for the existing DX indicates a
next generation Kindle DX could be in the works if not using the same
E Ink Mobius screen as the Sony digital notepad, potentially or
eventually. thus it would not suprise if the next DX is somewhere
between the existing and last launched pricepoint, instead of further
towards the 1K USD that is breaking new ground for a prefered display
for written, diagrammatic, textual, modeled information, organization,
and management that tends more towards the library than file cabinet
turning into a data junk drawer approach.
likewise, another such device for construction documents....
(logistics, networked data management)

PocketBook CAD Reader  // Fina screen
http://archinect.com/news/article/87978707/e-ink-introduces-display-and-new-pocketbook-tablet-for-use-on-the-construction-site

[video] Pocketbook CAD Reader Debuts in New Commercial
http://goodereader.com/blog/electronic-readers/pocketbook-cad-reader-debuts-in-new-commercial

note on kindle dx, autocad device, sony large-format!!, killer-app
missing: wikis. new www space (structured info) could be created using
it and other software as shared web-platform. ii.e. writing as wiki,
wiki as approach to writing, not serial strings, deep structural
concepts.
[concept] [concept] + [concept] diagrammatic approach to communication
(fractal r/w)


{educational fair-use of copyright, 2013}

Caligula, Monty Python and the Holy Grail, Spartacus




From electromagnetize at gmail.com  Fri Dec  6 23:55:24 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 7 Dec 2013 01:55:24 -0600
Subject: infra-org (urls)
In-Reply-To: <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <CADhsnxc3mKzZx9XrGAPYiVDPDx7b-tstk_Qyuk-k506MsVVSEw@mail.gmail.com>

> From: brian carroll <electromagnetize at gmail.com>
>
> 'Spooky action' builds a wormhole between 'entangled' quantum particles
> http://phys.org/news/2013-12-spooky-action-wormhole-entangled-quantum.html
>
>>note: i must have it all wrong because would it not be possible to
>>modify the spin of an entangled pair and have it influence the remote
>>particle likewise. and thus, what need of wires or fiber to connect
>>events, if a hybrid remote and on-site quatum processing were to take
>>place. an ecological or ecosystem context of connectivity in & out of
>>various structures via different forms of entanglement. what if 1,000
>>circuit boards shared a split particle and were sent to remote areas,
>>yet one calculation effected the others and likewise, or perhaps 1,000
>>remotely-connected processing functions embedded in 100,000 onsite. in
>>other words what if the processor were not discrete nor connected by
>>means other than resonance or vibration (perhaps decibels indicates
>>this as an acoustic measurement for light even). of course i have no
>>idea what i am saying, though as list fool i must speak such nonsense.

> "Spooky action" entanglement has been measured to operate at a velocity of
> at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals
> transmitted on optical fibers about 20 kilometers apart.)  Unfortunately,
> there does not appear to be any way to employ this to transmit information.
>        Jim Bell


so would this not break the physics model already, of faster than light info,
such that the cosmos may operate on principles beyond those employed.

the comments on the article seemingly indicative of this same scenario,
as if a realm of political science, gerrymandering of physics seemingly.

if a spin could be remotely connected to another, as mentioned in the
article comments, and activated at a distance, could this not function
as a basic switch, perhaps making a relay or gate or some kind or the
ability to send/receive coded messages via morse code (as mentioned).

say, a sequence of spins encoding the alphabet or whatever, perhaps
controlled by a normal computer process yet transmitted/received via
this quantum connectivity (seemingly out of this world then back into it
via vibration, rather than a line of sight acoustic signal, if understanding)

i thought that was the idea underneath the potential for other, hidden
technology embedded in existing systems, that remote relationship
via quantum properties that operate in other dimensionality/structures,
if not beyond lightspeed properties or conceptions, and that it may not
be recognizable in the existing approach or computational paradigm.
such that fiber may not be necessary, the approach to key exchange
or processing may occur in other parameters or functional structures.




From electromagnetize at gmail.com  Sat Dec  7 00:01:12 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 7 Dec 2013 02:01:12 -0600
Subject: infra-org (urls)
In-Reply-To: <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <CADhsnxc1nVuxJg3C2t91H-7nhaSUFxrx9uq1dMPnm+E6uPdqtw@mail.gmail.com>

>> 'Spooky action' builds a wormhole between 'entangled' quantum particles
>> http://phys.org/news/2013-12-spooky-action-wormhole-entangled-quantum.html

> "Spooky action" entanglement has been measured to operate at a velocity of
> at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals
> transmitted on optical fibers about 20 kilometers apart.)  Unfortunately,
> there does not appear to be any way to employ this to transmit information.
>        Jim Bell

i should have mentioned i think this is the model for basic consciousness,
as it relates to processing reality, logic, and pattern recognition. closely
related to ideas visually presented in the book:

Space-Time and Beyond: Toward an Explanation of the Unexplainable

authors: Fred Wolf, Jack Sarfatti, Bob Toben




From electromagnetize at gmail.com  Sat Dec  7 00:13:13 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 7 Dec 2013 02:13:13 -0600
Subject: infra-org (urls)
In-Reply-To: <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>

Jim Bell wrote:

> "Spooky action" entanglement has been measured to operate at a velocity of
> at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals
> transmitted on optical fibers about 20 kilometers apart.)  Unfortunately,
> there does not appear to be any way to employ this to transmit information.

it also makes me wonder, given the insane speed vs. infinitesimal distance
if *information* could operate as a kind of cognitive pressure on the mind,
(as with predictive Random Event Generator (REG) vs RNG where patterns
organize/emerge out of quantum-noisefield) thus corollary perhaps to the
analogy of water pressure for electrical circuits and flow based on pneuma-
tic dynamics in a potentially bounded or closed system). that may enter
into questions of 'where information actually exists', perhaps stored outside
the brain in noosphere as patterns or forms (invisible constellation/structure)
that is referenced or linked to rather than contained within a brain, and thus
boundary of brain vs. mind. same: digital computer vs.quantum processor,
perhaps. thus issue of channeling or tuning into versus as origin of truth.
what if a fundamentally different data model, thus security model, etc.

this conceptualization has the individual person modeled as an antenna,
tuning into various structures based on what resonates, aligns correctly,
what circuits or feedback loops or environments exist. versus machine
of clockwork, rote memorization, and processor speed of read/write.




From jya at pipeline.com  Sat Dec  7 03:24:50 2013
From: jya at pipeline.com (John Young)
Date: Sat, 07 Dec 2013 06:24:50 -0500
Subject: infra-org (urls)
In-Reply-To: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.g
 mail.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
Message-ID: <E1VpFzY-0000C1-MG@elasmtp-spurfowl.atl.sa.earthlink.net>

Contact mics for acquiring vibration and resonance emanations
are among the still classified TEMPEST offensive and defensive
activities, along with other multi-sensory and -physical acquisition
and transmission technologies.

The celebrated EM components of TEMPEST are commonly
used as subterfuges, ruses and ploys to divert attention from
the non-EM -- which an almost limitless number of animals and
other creatures use for SIGINT and COMINT, and a few like
Brian, unfettered by industry conceits, use for full-spectrum
HUMINT.

TSCM pros have made much of the EM threat and little of the
other, or pretend to do so. The US Embassy Moscow cavity
resonance bug, and a few others, are highlighted for the
same diversion from the slew of others inadvertently
ignored.

Thanks again to Brian for broadening the discussion from
narrow focus on crypto prowess and simple-minded EM
and TSCM, a narrowness which might be considered a
long running ploy not so different from the Snowden gush
generating reams of Chicken Little narrative beloved
by the comsec industry guided by its nose toward cash
and ignoring its tell-taling stench.





From odinn.cyberguerrilla at riseup.net  Sat Dec  7 12:52:22 2013
From: odinn.cyberguerrilla at riseup.net (Odinn Cyberguerrilla)
Date: Sat, 7 Dec 2013 12:52:22 -0800
Subject: Perhaps related? ABIS protocol Re: [Full-disclosure] Secure
 whistleblowing feedback / reporting systems in the content of compartmented
 information, endpoint security [was: [NSA bitching] [formerly Re: PRISM][]]
Message-ID: <71f8685272c0724d306c5fbe528f30d4.squirrel@fruiteater.riseup.net>

Perhaps this is related to what is being discussed here:

https://github.com/ABISprotocol/ABIS

 - if you find it interesting please drop your comments / thoughts, and if
interested in being a collaborator, please advise.

On Fri, 2013-10-18 at 08:18 -0700, coderman wrote:
> On Fri, Oct 18, 2013 at 4:40 AM,  <dan at geer.org> wrote:
> >...
> > http://geer.tinho.net/geer.uncc.9x13.txt
>
>
> an interesting discussion :)
>
> "This is perhaps our last fundamental tradeoff before the Singularity
> occurs: Do we, as a society, want the comfort and convenience of
> increasingly technologic, invisible digital integration enough to pay
> for those benefits with the liberties that must be given up to be
> protected from the downsides of that integration?" -- dan
>
>
> i would argue that there is an alternative in design and architecture,
> mainly those which decentralize and protect end-to-end. however, there
> is a cost attached to these efforts as well, which so far most opt-out
> of paying...
>
>
> best regards,
>

And I would reply that only those who commit to those efforts can see it
more clearly that there are no credit, financing or bitcoin scheme that
can side-step the payment.

Great article dan!

-- 
010
001
111




From seanl at literati.org  Sat Dec  7 13:15:34 2013
From: seanl at literati.org (Sean Lynch)
Date: Sat, 07 Dec 2013 13:15:34 -0800
Subject: infra-org (urls)
In-Reply-To: <CADhsnxc3mKzZx9XrGAPYiVDPDx7b-tstk_Qyuk-k506MsVVSEw@mail.gmail.com>
 (brian carroll's message of "Sat, 7 Dec 2013 01:55:24 -0600")
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CADhsnxc3mKzZx9XrGAPYiVDPDx7b-tstk_Qyuk-k506MsVVSEw@mail.gmail.com>
Message-ID: <87bo0ss6q1.fsf@literati.org>

On Fri, Dec 06 2013, brian carroll wrote:

>> "Spooky action" entanglement has been measured to operate at a velocity of
>> at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals
>> transmitted on optical fibers about 20 kilometers apart.)  Unfortunately,
>> there does not appear to be any way to employ this to transmit information.
>>        Jim Bell


> so would this not break the physics model already, of faster than light info,
> such that the cosmos may operate on principles beyond those employed.

> the comments on the article seemingly indicative of this same scenario,
> as if a realm of political science, gerrymandering of physics seemingly.

> if a spin could be remotely connected to another, as mentioned in the
> article comments, and activated at a distance, could this not function
> as a basic switch, perhaps making a relay or gate or some kind or the
> ability to send/receive coded messages via morse code (as mentioned).

> say, a sequence of spins encoding the alphabet or whatever, perhaps
> controlled by a normal computer process yet transmitted/received via
> this quantum connectivity (seemingly out of this world then back into it
> via vibration, rather than a line of sight acoustic signal, if understanding)

> i thought that was the idea underneath the potential for other, hidden
> technology embedded in existing systems, that remote relationship
> via quantum properties that operate in other dimensionality/structures,
> if not beyond lightspeed properties or conceptions, and that it may not
> be recognizable in the existing approach or computational paradigm.
> such that fiber may not be necessary, the approach to key exchange
> or processing may occur in other parameters or functional structures.

(Take everything I say here with a grain of salt; I'm not a quantum
physicist, nor have I ever even taken a quantum physics class. I just
read a lot about this stuff and think about it a lot.)

Quantum entanglement is inherently difficult to explain because it's a
consequence of the prevailing interpretation (the Copenhagen
interpretation) of quantum mechanics, that the spin axis isn't actually
"chosen" until you measure it. Unfortunately, the information that's
supposedly "transmitted" instantaneously doesn't originate from outside
the system, so it can't be used to send anything useful to human beings.

There's an explanation that's slightly less awkward in my view: that the
information about what axis you're measuring the spin on actually gets
transmitted backward in time along the particle's path to the point at
which the particles became entangled. It's less awkward because it
doesn't require anything to happen faster than light, and it doesn't
allow paradoxes because you can't actually get anything useful back
out. This interpretation is known as "time symmetric quantum mechanics,"
but unfortunately there aren't a whole lot of papers on it because the
Copenhagen interpretation is quite dominant.

Special Relativity itself actually doesn't forbid traveling or sending
information faster than light; it just forbids accelerating a massive
object to or through the speed of light. There has been talk of
"tachyons," particles "born" traveling faster than light and possessing
imaginary mass, since the earliest days of SR. Since they would allow
the creation of paradoxes and have other strange properties such as
accelerating as they lose energy, most physicists assume they do not
exist. They've even created a principle, the "Causality Principle," that
forbids them. The Causality Principle simply says that all observers
must observe two events that are causally connected (i.e. exchange any
information between them) occurring in the same order. This property can
only be true if information is transmitted at or below the speed of
light.

The Causality Principle is the weakest principle that prevents paradoxes
within Special Relativity, but it turns out a minor tweak to SR enables
a weaker principle to prevent paradoxes: the addition of a "privileged"
refernce frame. In particular, the reference frame in which quantum
entanglement is assumed to operate, which may also be the reference
frame of the cosmic microwave background. The revised, weaker Causality
Principle says that any two causally-connected events must be observed
to occur in the same order *to an observer in the privileged reference
frame.* That gets rid of the speed of light limit entirely, as long as
you don't travel back in time in this one particular reference frame. It
would probably also make the Copenhagen interpretation of QM preferable
to the time-symmetric interpretation, but I haven't thought that one
through yet (in fact, I don't understand how they measure the speed of
the quantum connection yet either).

That means quantum entanglement *could* actually carry useful
information, and we could (in theory, anyway) construct an Ansible.

Before you go off saying "but SR says there's no privileged reference
frame!" it actually doesn't. It says you don't *need* one. Lorentz
constructed the geometry Einstein borrowed for Special Relativity
specifically to explain why the Earth's motion relative to the
luminiferous ether could not be detected. Einstein's major contribution
(for SR, aside from E=mc^2) was the realization that Lorentz's geometry
obviated the need for a luminiferous ether entirely. But perhaps quantum
entanglement can give the luminiferous ether a new life.

-- 
Sean Richard Lynch <seanl at literati.org>
http://www.literati.org/~seanl/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131207/54d0d171/attachment.sig>

From seanl at literati.org  Sat Dec  7 13:22:58 2013
From: seanl at literati.org (Sean Lynch)
Date: Sat, 07 Dec 2013 13:22:58 -0800
Subject: infra-org (urls)
In-Reply-To: <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>
 (brian carroll's message of "Sat, 7 Dec 2013 02:13:13 -0600")
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>
Message-ID: <877gbgs6dp.fsf@literati.org>

On Sat, Dec 07 2013, brian carroll wrote:

> Jim Bell wrote:

>> "Spooky action" entanglement has been measured to operate at a velocity of
>> at least 10,000 'c', where 'c' is the speed of light in a vacuum.  (signals
>> transmitted on optical fibers about 20 kilometers apart.)  Unfortunately,
>> there does not appear to be any way to employ this to transmit information.

> it also makes me wonder, given the insane speed vs. infinitesimal distance
> if *information* could operate as a kind of cognitive pressure on the mind,
> (as with predictive Random Event Generator (REG) vs RNG where patterns
> organize/emerge out of quantum-noisefield) thus corollary perhaps to the
> analogy of water pressure for electrical circuits and flow based on pneuma-
> tic dynamics in a potentially bounded or closed system). that may enter
> into questions of 'where information actually exists', perhaps stored outside
> the brain in noosphere as patterns or forms (invisible constellation/structure)
> that is referenced or linked to rather than contained within a brain, and thus
> boundary of brain vs. mind. same: digital computer vs.quantum processor,
> perhaps. thus issue of channeling or tuning into versus as origin of truth.
> what if a fundamentally different data model, thus security model, etc.

> this conceptualization has the individual person modeled as an antenna,
> tuning into various structures based on what resonates, aligns correctly,
> what circuits or feedback loops or environments exist. versus machine
> of clockwork, rote memorization, and processor speed of read/write.

This is exactly the model of the mind that I believed in when I was in
college. These days I believe that consciousness consists of information
but that information, far from being static, is actually the connections
among potential events. It's like a complex machine: pull lever A here
and gear B over there moves. The complex set of (abstract, not concrete)
connections that makes up the "model" of our reactions to various sets
of stimuli *is* our consciousness, versus there being some component in
there that produces the illusion of consciousness.

I'm sure that sounds sort of crazy; condensing such a large set of
varyingly intuitive leaps into a single paragraph is probably not such a
great idea. Happy to provide more background on the list or privately
for anyone who's interested.

-- 
Sean Richard Lynch <seanl at literati.org>
http://www.literati.org/~seanl/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 835 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131207/7c724aff/attachment.sig>

From coderman at gmail.com  Sat Dec  7 17:27:48 2013
From: coderman at gmail.com (coderman)
Date: Sat, 7 Dec 2013 17:27:48 -0800
Subject: infra-org (urls)
In-Reply-To: <877gbgs6dp.fsf@literati.org>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>
 <877gbgs6dp.fsf@literati.org>
Message-ID: <CAJVRA1QSNgaOALQz+v6-QYCrdHZEoA7rVjA2gx0HVCkhjfyrOg@mail.gmail.com>

On Sat, Dec 7, 2013 at 1:22 PM, Sean Lynch <seanl at literati.org> wrote:
>> ...
>> this conceptualization has the individual person modeled as an antenna,
>> tuning into various structures based on what resonates, aligns correctly,
>> what circuits or feedback loops or environments exist. versus machine
>> of clockwork, rote memorization, and processor speed of read/write.
>
> This is exactly the model of the mind that I believed in when I was in
> college. These days I believe that consciousness consists of information
> but that information, far from being static, is actually the connections
> among potential events. It's like a complex machine: pull lever A here
> and gear B over there moves. The complex set of (abstract, not concrete)
> connections that makes up the "model" of our reactions to various sets
> of stimuli *is* our consciousness, versus there being some component in
> there that produces the illusion of consciousness.
>
> I'm sure that sounds sort of crazy;


actually, i have long held this view on an intuitive / elegance level
of understanding.  the continual expansion of our understanding of
quantum phenomena has only reinforced and clarified this model of
consciousness for me.

rather than sounding crazy, i am pleasantly surprised that others
grasp this concept of consciousness and are willing to embrace it!

this would be a fun tangent to discourse about, however, i'll save the
brain as quantum antenna linked to body via nerve cell transducers for
another day...  ;)


best regards,




From bill.stewart at pobox.com  Sat Dec  7 20:40:30 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Sat, 07 Dec 2013 20:40:30 -0800
Subject: infra-org (urls)
In-Reply-To: <877gbgs6dp.fsf@literati.org>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>
 <877gbgs6dp.fsf@literati.org>
Message-ID: <20131208044626.6327EFD64@a-pb-sasl-quonix.pobox.com>

 > Consciousness is something really complex we don't really understand.
 > Quantum physics is something really complex we don't really understand.
 > Therefore, Consciousness must be a Quantum Physics thing!  QED.

If that works for you, you could go see the What the Bleep Do We Know 
(whatthebleep.com),
which has a bunch of new-agey people who don't understand 
consciousness or physics
and a few physicists who do understand physics being taken out of context.
It was in theaters a few years back, and seems to have a 
direct-to-DVD sequel or director's cut or something.
If you do know physics, I'd recommend getting high before you see it...





From coderman at gmail.com  Sat Dec  7 21:06:40 2013
From: coderman at gmail.com (coderman)
Date: Sat, 7 Dec 2013 21:06:40 -0800
Subject: infra-org (urls)
In-Reply-To: <20131208044626.6327EFD64@a-pb-sasl-quonix.pobox.com>
References: <CADhsnxd4VxrcouEy9q6sy6tk5=mvwH3xrxc7U2tAUBHbmncZ5A@mail.gmail.com>
 <1386401574.12541.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CADhsnxfDDxugQ1wvcLMvhnO_osdHD4sxdv7t55gh7XFNUoPy5A@mail.gmail.com>
 <877gbgs6dp.fsf@literati.org>
 <20131208044626.6327EFD64@a-pb-sasl-quonix.pobox.com>
Message-ID: <CAJVRA1QWVicYqzONRGjh-iEghZFRO9bwAJoWMUBgXMeOdCeuxA@mail.gmail.com>

On Sat, Dec 7, 2013 at 8:40 PM, Bill Stewart <bill.stewart at pobox.com> wrote:
>> Consciousness is something really complex we don't really understand.
>> Quantum physics is something really complex we don't really understand.
>> Therefore, Consciousness must be a Quantum Physics thing!  QED.
>
> If that works for you, you could go see the What the Bleep Do We Know


that movie discussed a few interesting concepts, but was overall too
annoying/incorrect for me to enjoy :/


regarding the role of quantum effects on consciousness, i am mostly
dismissing the purely deterministic models of consciousness arising
out of chemical interactions or fields only.

consider instead the role of quantum effects within the brain as
influence on nerve behavior within a integrated information theory of
consciousness...




From coderman at gmail.com  Sun Dec  8 00:22:48 2013
From: coderman at gmail.com (coderman)
Date: Sun, 8 Dec 2013 00:22:48 -0800
Subject: NSA morale down
Message-ID: <CAJVRA1S-pGBc38JOX8v5ZOWikY4PqeN0LcrN5sCDyTAinAckmw@mail.gmail.com>

the portrayals from the brass and insiders is, "the administration is
not showing enough support!".

i have to wonder: how many rank and file are feeling betrayed by the
NSA administration instead?   they're now getting a look into all the
SCI bits they were compartmented from before; able to see a bigger
picture full of invasive technical excesses and legal abuses...

"""
A second former official said NSA workers are polishing up their
résumés and asking that they be cleared — removing any material linked
to classified programs — so they can be sent out to potential
employers. He noted that one employee who processes the résumés said,
“I’ve never seen so many résumés that people want to have cleared in
my life.”
"""

it remains to be seen if they simply jump to private sector who are
just as bad, or pursue less offensive careers entirely.

---

http://www.washingtonpost.com/world/national-security/nsa-morale-down-after-edward-snowden-revelations-former-us-officials-say/2013/12/07/24975c14-5c65-11e3-95c2-13623eb2b0e1_print.html

NSA morale down after Edward Snowden revelations, former U.S. officials say

By Ellen Nakashima, Published: December 7

Morale has taken a hit at the National Security Agency in the wake of
controversy over the agency’s surveillance activities, according to
former officials who say they are dismayed that President Obama has
not visited the agency to show his support.

A White House spokeswoman, Caitlin Hayden, noted that top White House
officials have been to the agency to “express the president’s support
and appreciation for all that NSA does to keep us safe.”

It is not clear whether or when Obama might travel the 23 miles up the
Baltimore-Washington Parkway to visit Fort Meade, the NSA’s
headquarters in Maryland, but agency employees are privately voicing
frustration at what they perceive as White House ambivalence amid the
pounding the agency has taken from critics.

An NSA spokeswoman had no comment.

Obama in June defended the NSA’s surveillance as lawful and said he
welcomed the public debate prompted by revelations from former
contractor Edward Snowden beginning that month.

Though Obama has asserted, for instance, that the NSA’s collection of
virtually all Americans’ phone records is lawful and has saved lives,
the administration has not endorsed legislation that would codify it.
And his recent statements suggest he thinks some of the NSA’s
activities should be constrained.

A senior administration official who was not authorized to speak on
the record said that the White House would normally not endorse
legislation so early in the process but that “it’s been clear . . .
that we prefer legislation” that preserves the phone records program
“while making some changes . . . to potentially strengthen oversight
and transparency.”

Said Hayden: “The president has the highest respect for and pride in
the men and women of the intelligence community who work tirelessly to
protect our nation. He’s expressed that directly to NSA’s leadership
and has praised their work in public. As he said: ‘The men and women
of our intelligence community work every single day to keep us safe
because they love this country and believe in our values. They’re
patriots.’ ”

She noted that in recent weeks, Lisa Monaco, assistant to the
president for homeland security and counterterrorism, and Denis
McDonough, the White House chief of staff, visited Fort Meade “to
express the president’s support and appreciation for all that NSA does
to keep us safe.”’

Supporters of the NSA say staffers are not feeling the love.

“The agency, from top to bottom, leadership to rank and file, feels
that it is had no support from the White House even though it’s been
carrying out publicly approved intelligence missions,” said Joel
Brenner, NSA inspector general from 2002 to 2006. “They feel they’ve
been hung out to dry, and they’re right.”

A former U.S. official — who like several other former officials
interviewed for this story requested anonymity because he still has
dealings with the agency — said: “The president has multiple
constituencies — I get it. But he must agree that the signals
intelligence NSA is providing is one of the most important sources of
intelligence today.

“So if that’s the case, why isn’t the president taking care of one of
the most important elements of the national security apparatus?”

The White House, observers say, is caught between competing desires to
preserve what it has said are valuable national security programs and
to shield the president from criticism from allies abroad and
civil-liberties advocates at home.

Some observers said it is not surprising that Obama would not travel
to Fort Meade before internal and external reviews of surveillance
activities have been completed. The reviews are expected to be done
soon.

The NSA’s director, Gen. Keith Alexander, who is retiring in the
spring after 81 / 2 years, has been the most vocal defender of the
agency’s 35,000 employees. In speeches he has noted that more than
6,000 of them went to Iraq and Afghanistan to support the military. He
has spoken of how 22 cryptologists were killed. “They’re the heroes —
not the media leaker,” he said in a September speech, in a reference
to Snowden.

NSA counterterrorism analysts have worked “every weekend for eight
years since I’ve been here. . . . Twenty-four hours a day, seven days
a week, they’re there to defend us,” he said then.

On Thursday, Obama said on MSNBC that he would be proposing “some
self-restraint on the NSA” and “some reforms that can give people more
confidence.”

In an interview with NBC last month, he said: “In some ways, the
technology and the budgets and the capacity [at NSA] have outstripped
the constraints. And we’ve got to rebuild those in the same way that
we’re having to do on a whole series of capacities . . . [such as]
drone operations.”

Civil-liberties advocates generally agree with that sentiment, but
they would go further and say that the NSA’s bulk collection of
domestic phone records is unlawful and ought to be ended.

Former officials note how President George W. Bush paid a visit to the
NSA in January 2006, in the wake of revelations by the New York Times
that the agency engaged in a counterterrorism program of warrantless
surveillance on U.S. soil beginning after the Sept. 11, 2001,
terrorist attacks. “Bush came out and spoke to the workforce, and the
effect on morale was tremendous,” Brenner said. “There’s been nothing
like that from this White House.”

A second former official said NSA workers are polishing up their
résumés and asking that they be cleared — removing any material linked
to classified programs — so they can be sent out to potential
employers. He noted that one employee who processes the résumés said,
“I’ve never seen so many résumés that people want to have cleared in
my life.”

Morale is “bad overall,” a third former official said. “The news — the
Snowden disclosures — it questions the integrity of the NSA
workforce,” he said. “It’s become very public and very personal.
Literally, neighbors are asking people, ‘Why are you spying on
Grandma?’ And we aren’t. People are feeling bad, beaten down.”




From coderman at gmail.com  Sun Dec  8 00:44:02 2013
From: coderman at gmail.com (coderman)
Date: Sun, 8 Dec 2013 00:44:02 -0800
Subject: NSA morale down
In-Reply-To: <CAJVRA1S-pGBc38JOX8v5ZOWikY4PqeN0LcrN5sCDyTAinAckmw@mail.gmail.com>
References: <CAJVRA1S-pGBc38JOX8v5ZOWikY4PqeN0LcrN5sCDyTAinAckmw@mail.gmail.com>
Message-ID: <CAJVRA1R-eqD5vQ9uE5_ah5QNQceAAfgj1mZdBFZZ=kaCFJwmfA@mail.gmail.com>

On Sun, Dec 8, 2013 at 12:22 AM, coderman <coderman at gmail.com> wrote:
> ...
> it remains to be seen if they simply jump to private sector who are
> just as bad, or pursue less offensive careers entirely.

by private sector i'm thinking of companies like Statfor more than Amazon...


http://cryptome.org/2013/12/wl-stratfor-popovic-ows.htm
"""
... Below are a series of articles this past week about
internationally acclaimed activist, Srdja Popovic, and his involvement
with the private intelligence firm Stratfor.

... If anyone has information about CANVAS or Srdja Popovic, please
feel free to contact me at zoealif[at]gmail.com. I am currently
writing a blog post on the story.
"""




From electromagnetize at gmail.com  Sun Dec  8 08:58:02 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 8 Dec 2013 10:58:02 -0600
Subject: EM-nature (was: infra-org)
Message-ID: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>

JYA wrote:

> The celebrated EM components of TEMPEST are commonly
> used as subterfuges, ruses and ploys to divert attention from
> the non-EM -- which an almost limitless number of animals and
> other creatures use for SIGINT and COMINT...

i need to make note of this observation because it has special
relevance for the present situation of shared observation regarding
'information operations' (or other) that occur and-or are analyzed
within a particular context, framework, conceptualization. because
there is a split in worldview and modeling between the animal realm
whereby the sonar of bats or directional navigation of birds become
detached in their EM abilities from similar non-recognized natural
abilities in humans, which are 'off the map' so to speak, in terms
of a general awareness and recognition of similar EM physiology.

in other words, 'the senses' of humans are detached from their
electromagnetic context that would unify a model of humanity
(to be discussed at some later time) with such EM nature and
provide context for both a healthy relation and toxic conditions.
though this remains unrecognized via a political agenda that
prevents such data beyond its protected ideological boundary,
thus effects of wi-fi or artificial radiation (radio, etc) on human
beings is categorized into a realm of personal 'mental illness'
and unrelated to issues of cancer, at the same time EM tools
(nuclear resonance) are used to treat the ~mystery disease.

it is a split between mind-body that is enforced institutionally,
disallowing EM viewpoint while leveraging its onesidedness
against dumbed-down populations, unable to reason within
the warped frameworks about what is going on, because the
cause and effect have been separated, plausibly denied. in a
context of 'information operations' and 'electronic warfare' this
involves a realm of ~supernatural-like events that thus cannot
be accounted for in a non-electromagnetic context or view,
such that it cannot be 'rationally' reasoned with beyond a
realm of forced hysteria, as if dealing with ghosts/demons,
versus technological infrastructure operating in other realms.

thus security, defense, attacks are in a realm of "beliefs"
that are detached from a shared understanding/knowledge
of the environment these events are operating/occurring within,
like magic or witchcraft or sorcery, exfiltrating data and then
using a god-status to manipulate peoples lives - now this is
the power of government that is beyond oversight, law itself.

entire realms of ideological attackers then can be aligned in
such a ~wildwest scenario as if a replay of cowboys/indians,
the model for basic exchange moves towards highway robbery
in this same approach, detached from the actual condition that
exists, unable to speak about it or confirm it, as with physics
that supposedly "define" reality at the material level yet which
are byzantine and disconnected views that disallow reasoning
and observation while seeking to represent, have control over it
as ideology - this massive obfuscation the success of relativism.
so that nothing and only nothing can be discussed and the left
is rest for experts. in this way, silence is enforced via ideology
that is actually _detached from nature yet claims to represent it
and so to the mind and imagination and body of humans, these
as they are detached from the environment they exist within as
this becomes the basis for exploitation, predator/prey relations
at the level of politics of the rogue state, homicidal government.

in this way little can be said or done without being discredited
for going 'beyond the lines' that are dutifully enforced by the
protectors and defenders of the corrupt ideology, this boundary
is what needs to stand, the misrepresentation and malmodeling
of existence so that _reason cannot occur in accurate terms,
mathematics (of zero) and michelson-morley experiment (as
if simple debunk of aether) and removal of the absolute from
all equations, then acting and believing as if this is NORMAL
when it is fundamentally unreal as to shared experience and
observation of known and knowable facts and observations.
instead it becomes about what is allowed via a viewpoint
that can remain secure while allowing other views to exist,
within certain parameters yet truth is lost in this confinement
to a finite, overcontrolled, self-interested, skewed interaction,
whereby "nothingness" continually replaces "being" as the
shared condition, while those administering technology can
further apply and ply their craft and trade against and upon
humans, while humans have no effect on this relationship,
it is a bias that is enforced by dark ages restrictions upon
thought, held within an outdated view, stagnation of beliefs
for hundreds if not thousands of years of knowledge (basic
amber and lodestone fundamentals continually extended,
technologized) whereby even the fact that the atmosphere
itself is full of charge is irrelevant to those whose interest
is in technology, as if the 'data model' for information only
exists in artificial media and not within EM nature itself,
that beings could be interacting and formatted the shared
environment like the r/w head of a harddrive via mind, yet
the considerations never go outside the skull or beyond
the 'expert models' that bound this to the brain instead.
as if people cannot be allowed to think for themselves
or perhaps know far more than "beliefs" of scientists
allow via its enforcement of a corrupt political ideology,
where this bias against accurate human representation
that gives rise and momentum to an antihuman agenda,
a religious belief system that is biased against humans
as this is turned into infrastructure, tools, government.
and at its core is nothingness. falsity, lies. not truth.
it is language games. it is disregard for, exploitation
of logic whereby proofs are unneeded, never checked-
beyond language in its ungrounded condition and this
very comprehensiveness is itself based on absolutism,
where 'it cannot be known' becomes this absolute truth
simultaneously denied by the same political priesthood
whose goal is to mislead, misdirect, to keep us enslaved
in a false worldview, model, "physics" detached from reality

the disconnection of accurate understanding of the mind,
as if we cannot be allow to think or know consciousness
even, outside the scientific technological evaluation within
a biased modeling, then forbids accurate connection and
evaluation with the electromagnetic body, nervous system,
senses, in terms of awareness, reasoning, truth itself as
it relates to information (and security) beyond 'the brain',
and all the senses in their variability as they are unified
and not kept separate within human and other entities.
yet this wholeness is illegal as an identity, observation
is forcibly denied, the perspective directly challenges
the technical and ideological and political advantage of
those using these warped harmful tools and exploits
against the population, to continue their illegal control
over events to the deterioration of earth, its inhabitants

when truth is outlawed there is no way to 'reason' about
such conditions. they are penalized as viewpoints and
this defines a boundary condition or protected threshold
of different values, economic/political/social interests
that separate, some mind and bodies benefit for this
while others must suffer as a result of ongoing deception.
for some it is their security model, this obfuscated realm.
for others, humans, it is the basis for insecurity, torment,
disconnection for action and ability, realism, truth itself

thus reality is legislated away by others who stand in
for the law, on their own terms, for their own benefit
while others must suffer for this to be sustained, yet
if some take on more suffering via self-sacrifice, this
condition could be fundamentally transformed, given
rules of operation changed, hacked, short-circuited
and switched into other circuits, functionality, and
then the situation becomes increasing interesting
worldwide, as unified understanding takes control,
governed by shared service to truth, firstly, finally

▲ ◁ ▼




From jya at pipeline.com  Sun Dec  8 09:49:19 2013
From: jya at pipeline.com (John Young)
Date: Sun, 08 Dec 2013 12:49:19 -0500
Subject: NSA morale down
In-Reply-To: <CAJVRA1R-eqD5vQ9uE5_ah5QNQceAAfgj1mZdBFZZ=kaCFJwmfA@mail.g
 mail.com>
References: <CAJVRA1S-pGBc38JOX8v5ZOWikY4PqeN0LcrN5sCDyTAinAckmw@mail.gmail.com>
 <CAJVRA1R-eqD5vQ9uE5_ah5QNQceAAfgj1mZdBFZZ=kaCFJwmfA@mail.gmail.com>
Message-ID: <E1VpiTA-0000cN-Tu@elasmtp-spurfowl.atl.sa.earthlink.net>

Most NSA employees, like all spy agencies, do not participate
directly in special ops, any more than most military members
do not engage in combat. So they are terribly displeased when
the exposed war carnage breaks the bubble of prestige and
admiration bestowed on the whole clan for recruitment,
pensions, awards and ceremonial burial. NSA had a relatively
clean record, compared to other spies, until the fan was
hit with Snowden.

Snowden learned that working for a spy or military contractor
under guise of ennobling public service is a shock at how
badly hires and ex-officials are treated: produce and fulfill
new contracts damn quickly or get the fuck out. So he got
out.

All the perks of official service are no where to be seen,
and being shit on by bosses is much worse than that of the
non-secretkeepers who can abuse with impunity on behalf
natsec. To earn the dirty-work salaries means to eat their
shit, no valor, no medals, no pride, just shameless profits.

Which is why quite a few go back into official service after
a taste of raw capitalism always rotting. And, not least, why
even more adjust their ethics and morals to fit what the
corporations expect for predator-grade dollars a year.
Thus, millionaire Michael Hayden, who led the privatizing
initiative with a gang of venal directors and is reaping
payola for demonizing Snowden. And so is Alexander
preparing a place in that select TS/SCI Codeword crowd.

Infosec-comsec firms and experts play this duplicity game
exceedingly well, feet in both camps, hands in both pockets,
via dual-use tech and contracts, and it is to be expected that
evidence of that classified duplicity is being withheld by the
Snowden information managers, aided and abetted by those
very experts in lawful business corruption and deception,
protected by secrecy. Clues repeatedly proclaimed
by the press outlets: officials ask, demand, threaten,
don't publish names, addresses, emails, contractors'
names. Kiriakou and Hammond await you.

The sweet smell of success: joining the secretkeeping
crowd for future rewards by way of irresistable offers.

Guess how much will be offered to deliver Snowden and
his unpublished cache (if not Greenwald and Poitras too)
by one or more of his information fences by bribe and
threat? Sabu is ROTFLHAO, wearing a medal for taking
the piss.

Probably the biggest downer for the nobody NSA grunts
is observing the golden rewards of lying to the public. If
that disenchantment goes the right way, there well be
a steady stream of Snowdens delivering their bundles
to publishes, or best, self-publishing and bypassing
the venal MTMs enjoying fucking over sources.



At 03:44 AM 12/8/2013, you wrote:
>On Sun, Dec 8, 2013 at 12:22 AM, coderman <coderman at gmail.com> wrote:
> > ...
> > it remains to be seen if they simply jump to private sector who are
> > just as bad, or pursue less offensive careers entirely.
>
>by private sector i'm thinking of companies like Statfor more than Amazon...
>
>
>http://cryptome.org/2013/12/wl-stratfor-popovic-ows.htm
>"""
>... Below are a series of articles this past week about
>internationally acclaimed activist, Srdja Popovic, and his involvement
>with the private intelligence firm Stratfor.
>
>... If anyone has information about CANVAS or Srdja Popovic, please
>feel free to contact me at zoealif[at]gmail.com. I am currently
>writing a blog post on the story.
>"""





From jya at pipeline.com  Sun Dec  8 10:12:53 2013
From: jya at pipeline.com (John Young)
Date: Sun, 08 Dec 2013 13:12:53 -0500
Subject: EM-nature (was: infra-org)
In-Reply-To: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.g
 mail.com>
References: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>
Message-ID: <E1Vpipz-0003SF-8q@elasmtp-banded.atl.sa.earthlink.net>

The earliest and most enduring form of infosec -- crypt-crypto --
is non-EM, non-language, non-homo-erectus. Current versions contain
vestigals of those primitives in what is disingenuously termed
implementation. And it is in implementation where most comsec
failures occur and where most successes succeed. Code is
closer to whistling in the dark, baying at the moon, offering newborns
to hungry wolves.

Implementation is 99.99+% of infosec-comsec, perhaps 100%.
Code hardly scratches the surface and might be constructively
seen as a ruse, a strategem, concocted and promoted to delude.

Delusion is the prime purpose of implementation. Code inebriation
creates phantasms of security by ignoring signs of predators
aprowl where coders live, work, sleep, chat OTR and post.

David Kahn, among others, amply desribes the range of
implementation, its short-term successes and long-term
delusions. Nothing finer in Carolina than belief in an
invulnerable cryptosystem. Less noticed is the effectiveness
of promulgating an invulnerable comsec or cryptosystem to
encourage widespread use. As seen today, not only in the
fantastic rise of the comsec industry but also in the frantic
efforts to keep the ball rolling to counter Snowden's
disclosures of delusion.

At 11:58 AM 12/8/2013, Brian Carroll wrote:

i need to make note of this observation because it has special
>relevance for the present situation of shared observation regarding
>'information operations' (or other) that occur and-or are analyzed
>within a particular context, framework, conceptualization. because
>there is a split in worldview and modeling between the animal realm
>whereby the sonar of bats or directional navigation of birds become
>detached in their EM abilities from similar non-recognized natural
>abilities in humans, which are 'off the map' so to speak, in terms
>of a general awareness and recognition of similar EM physiology.

Rest good stuff elided. 





From electromagnetize at gmail.com  Sun Dec  8 12:16:14 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 8 Dec 2013 14:16:14 -0600
Subject: EM-nature
Message-ID: <CADhsnxd2H6XwQ0_LHsY-+-+YpfOEH7VrHSNQP33mQ+NavwdD-Q@mail.gmail.com>

// apologies for the quixotic ranting this involves. it is
// directed at a prevailing ideological condition readily
// encountered most everywhere and institutionalized,
// though also pervades communications frameworks
// in which ideas take place, outside logical accounting
// beyond language itself, thus bias/distortion built-into
// structure for conveying observations, not removed.
// science and technology is heavily invested in this
// viewpoint, reliant upon it, to the point it is religion-
// yet detached from, nonobservant of greater truth. in
// this way, a privileged hierarchical perspective where
// technological tools themselves operate in bounded
// and biased condition as if neutral, due to ideology
// when instead warped, twisted, turned against self.
// in this way, to interrogate the crooked windmillery

(regarding default scenario: waffling into oblivion...)

for instance, if the mathematics of zero is off, then use
of such equations reliant on this modeling are going to
bound observations into a realm of perpetual inaccuracy
as a basis for worldview and 'physics' itself

likewise, if politically expedient, within this boundary,
a model of relativism can continually be reinforced via
these mathematics, it further provides a framework that
declares a particular reality to be the shared situation,
even if this goes against common sense, experience,
truth, and knowledge. physics then determining it as
if judge, jury, ultimately executioner of 'bad thinking'
because it does not conform to the inaccurate model

such as astronomers believing goats ruled earth
from the moon or whatever other such beliefs, if
enforced and stopping other direct observations
because they do not conform to the belief system

much more accurate in a charged atmosphere that
we are beings are _submerged in an information
environment, a realm of invisible circuitry that has
fundamental relation to pattern and constellations
of data, models that repeat as concepts and ideas,
and where do these reside, only inside of brains?

this is why the jellyfish seemed a useful analogy,
a floating sentience suspended in an information
rich environment that then is mediated, tuned into,
related to and through within certain dimensionality
that may change from one being, species to the next
and yet some fundamental condition is also shared,
held in common, this is the electromagnetic context
that is _undocumented in both nature and humans
as a continuous circuit throughout the cosmos from
the beginning of its existence to peak development
of life and sentience unfolding at its very edge, that
is where consciousness is operating, alive, interface
to reality and able to reflect upon this condition

yet without a unified model, EM cosmography
necessary before EM cosmology, seemingly, to
consider EM nature in relation to EM lifeforms,
and then EM humans and EM technology within
this realm, as 'consciousness' and concepts like
code, programming, 'artificial intelligence' are
inherently related to this condition in its truth,
yet completely separated from it due to a non-
electromagnetic worldview, understanding, as
if computers invented and 'contain' charge vs.
everything containing charge in a given realm,
plants, animals, the air, tools, bodies, minds.

the circuit itself not even a concept beyond
the manufactured circuitboard in terms of a
diagrammatic approach to reasoning, that is
processing of reality and decision-making,
such that perhaps this too is about circuits,
and we cannot reason or communciate in
the way we actually think, via patterns as
our worldview is disconnected from them,
from our own observation, and made into
signs instead, held apart from geometry,
other structural relations and evaluations
that may predate or provide foundation
for more ornate descriptions thereafter
yet these fundamentals are not secured
and instead lost in a non-EM evaluation,
as if 'writing to write' or 'coding to code' is
a higher connectivity or awareness when
instead it is a further detachment from the
fundamentals, truth in its logical evaluation
needed to secure the modeling, test and
correct for errors, the obligation ignored,
denied for a simple, quicker lost cause,
moving in the wrong direction, forgetting
to listen to the compass built-into the
self, of the electromagnetic directionality,
its connection with this cosmic condition
and the naturalness and unity, harmony
that could exist with people, environment,
tools, instead ignored, disease, disharmony
and falsity taking the place of enlightenment

then to speak of anything detached from this
condition as if encompassing it in a too small,
finite worldview, believing infinity can be pre-
packaged into a confined condition and then
held there as mode of control over it, versus
freeing the infinity truth and human reasoning,
challenging the concepts and regulations of
'discourse' and 'institutionalization of views',
to achieve this greater accuracy, _security
instead becomes the very problem that must
be combated to defend, uphold the criminal
falsity and deception of a false worldview,
false reality, false perspective, false beliefs
that are normalized, enforced, dictated

in this way what is anything in its truth
without this electromagnetic context as
the foundation for its evaluation, and this
in all its dimensionality, not compartmented
into narrowed controlled categories that are
the basis for its denial via social protocols
that seek to uphold a given social order that
does not serve or seek this greater truth and
instead desires to substitute it, stand-in for it,
as guardians though of the false, nothingness

code, crypto in this context, tools, computers,
programming, reasoning, processing, thought,
security, insecurity, tyranny, freedom, laws

how do you move from infinite parallel worlds
in relativistic conditions into a single shared
empirical framework in varying dimensionality
via quantum conditions without EM-nature?
how do you do this if the mathematics do not
allow it. or an absolute framework is not allowed
within reasoning via the ideology of relativism as
it has been detached from logical accounting
beyond the binary onesided belief of ideology.


what if the model of information survives death,
that like energy, if information is attached to it
as pattern in some way, whether morphic fields
or other conceptual forms or formatting, patterns
that even these computer conversations could
already be occurring interdimensionally, beyond
given thresholds yet not perceived locally this way.
none of it can be rationalized if the foundation for
the worldview is off, wrong, fundamentally incorrect
and there is every indication that this is the case,
yet further, that it purposeful, to maintain control
over events by denying the true nature of reality
and seeking to control and exploit this against
human populations, for their political subjugation
that is driven by evil intent, exampled everywhere

then to communicate or talk in this realm as if
it is not happening, beyond the pale to mention
as if craziness. that is threshold of the different
groundings, the ruling ideology based on falsity
all its circuitry open to hacking and cracking,
awaiting horn to announce the games begin...

❉ ✴ ❇

example of diagrams shared on defunct electronetwork-list
https://www.dropbox.com/sh/hdp28xagjr4d0us/RX2WLmrK3z
-------------- next part --------------
A non-text attachment was scrubbed...
Name: relations.gif
Type: image/gif
Size: 8685 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131208/93d7e7f0/attachment.gif>

From electromagnetize at gmail.com  Sun Dec  8 12:32:47 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 8 Dec 2013 14:32:47 -0600
Subject: EM-nature (was: infra-org)
In-Reply-To: <E1Vpipz-0003SF-8q@elasmtp-banded.atl.sa.earthlink.net>
References: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>
 <E1Vpipz-0003SF-8q@elasmtp-banded.atl.sa.earthlink.net>
Message-ID: <CADhsnxe2pnDkaU5M_tScwKa1ezkYN4n-Nv1EiCwYMTGXsGZOxA@mail.gmail.com>

John Young wrote:

> The earliest and most enduring form of infosec -- crypt-crypto --
> is non-EM, non-language, non-homo-erectus. Current versions contain
> vestigals of those primitives in what is disingenuously termed
> implementation. And it is in implementation where most comsec
> failures occur and where most successes succeed. Code is
> closer to whistling in the dark, baying at the moon, offering newborns
> to hungry wolves.

i am completely intrigued and at once baffled by this, wondering
of Code here is referencing code in a wider generic sense or is
restricted to computer coding as the parameters. the examples
given {whistling, baying} seem both in a realm of music/voicing
and movement {gesture} and these all could be contained within
a context of language, seemingly. or perhaps not, as envisaged.

what has me further curious is if this somehow has linguistics
(as crypt.crypto) advantaged to mathematics, as communication
framework in some wider more open or elusive sense, or as the
conception/conceptualization of what code is or may be if crypto

> Implementation is 99.99+% of infosec-comsec, perhaps 100%.
> Code hardly scratches the surface and might be constructively
> seen as a ruse, a strategem, concocted and promoted to delude.

i am still trying to ground with electromagnetic framework thus
imagining beyond this, as if already grounded, more unknowing
of how to even consider such thoughts or considerations as it
difficult or impossible to separate from the medium involved in
my naive and limited awareness and even less understanding

closest to this perhaps in this not-knowing what might be is
that the cosmos itself is encrypted, as a starting point to
questioning, context for developing technical crypt.boxes

then perhaps DNA as encrypted code of life in this framework,
taxonomy of species and disciplines decrypting the patterning,
securing truth key to unlocking the works seemingly, OZ writer
L. Frank Baum naming electromagnetism as the master key,
wondering if it is actually a blank, then what that implies, or if
parameters exist by which it can be made to unlock access
to new dimensions in which this otherness is more tangible,
maybe a realm exists outside of charge, here not the case
at least in the level experienced or encountered, precorpse
in the necropolis, is everything then only "information", etc.

[whitespace]




From electromagnetize at gmail.com  Sun Dec  8 13:29:01 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 8 Dec 2013 15:29:01 -0600
Subject: EM-nature (was: infra-org)
In-Reply-To: <E1Vpipz-0003SF-8q@elasmtp-banded.atl.sa.earthlink.net>
References: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>
 <E1Vpipz-0003SF-8q@elasmtp-banded.atl.sa.earthlink.net>
Message-ID: <CADhsnxf0QQEkzBcuQ+59KiKJQ-e5ZhLjMDYELTb3Jh1SGzmBFg@mail.gmail.com>

(now i realize i likely misread, strange-read/reply-functioned your post,
not quite or completely grokking the distinction between crypt.crypto
and implementation, separation or distancing of these though still the
relation to nature itself as example appears retained, as if providing
proof-of-concept and demonstration models for how to go about it,w
watching various creatures, ecosystems, crystals, particle dynamics)


John Young <jya at pipeline.com> wrote:

> The earliest and most enduring form of infosec -- crypt-crypto --
> is non-EM, non-language, non-homo-erectus. Current versions contain
> vestigals of those primitives in what is disingenuously termed
> implementation. And it is in implementation where most comsec
> failures occur and where most successes succeed. Code is
> closer to whistling in the dark, baying at the moon, offering newborns
> to hungry wolves.
>
> Implementation is 99.99+% of infosec-comsec, perhaps 100%.
> Code hardly scratches the surface and might be constructively
> seen as a ruse, a strategem, concocted and promoted to delude.
>
> Delusion is the prime purpose of implementation. Code inebriation
> creates phantasms of security by ignoring signs of predators
> aprowl where coders live, work, sleep, chat OTR and post.
>
> David Kahn, among others, amply desribes the range of
> implementation, its short-term successes and long-term
> delusions. Nothing finer in Carolina than belief in an
> invulnerable cryptosystem. Less noticed is the effectiveness
> of promulgating an invulnerable comsec or cryptosystem to
> encourage widespread use. As seen today, not only in the
> fantastic rise of the comsec industry but also in the frantic
> efforts to keep the ball rolling to counter Snowden's
> disclosures of delusion.




From bill.stewart at pobox.com  Sun Dec  8 21:01:32 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Sun, 08 Dec 2013 21:01:32 -0800
Subject: EM-nature (was: infra-org)
In-Reply-To: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.g
 mail.com>
References: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>
Message-ID: <20131209050153.F147CF1DE@a-pb-sasl-quonix.pobox.com>


>JYA wrote:
> > The celebrated EM components of TEMPEST are commonly
> > used as subterfuges, ruses and ploys to divert attention from
> > the non-EM -- which an almost limitless number of animals and
> > other creatures use for SIGINT and COMINT...

Back in the 80s I ran a TEMPEST-shielded computer room,
with a VAX 11/780 and later some Sun-2 workstations,
doing studies for the government that they didn't want
Commie Spies listening to.

The shielding was basically plywood with sheet metal on both sides,
with special metal joints in between them and on the corners,
packed with wire mesh in the joints to plug any extra leaks,
making a nice big Faraday cage.  The air vents were metal grates
an inch or two deep with zig-zaggy airflow paths,
and our data connections used fiber optics going through
waveguide holes that were about 3" long and 1/8" diameter.
Power feeds used big inductive low-pass filters.

We measured the RF-tightness using meters that ran at 450 MHz,
trying to keep things 120dB tight.  You had one person carry a
transmitter on one side of the wall, another person a reader on the other side.
One experiment we'd occasionally do was to stick a wire
through the fiber waveguides, and if you got more than halfway through,
that was enough for 450MHz to leak out.  I'm not sure what frequencies we
*really* needed to protect against, but the Vax ran at something like 10 MHz,
so 450MHz was way overkill for any harmonics that might happen.

What occurred to me recently was that 10 MHz computers may have been
state of the art for the mid-80s, but that was a lot of iterations of
Moore's Law ago, and I doubt the technology of the time is much use
for current 2-3 GHz laptops.  The main Faraday cage should be fine,
plus or minus a bit of extra copper tape to plug minor leaks,
but all the air vents are going to be awfully leaky at those frequencies.
Any idea what people use today?





From coderman at gmail.com  Mon Dec  9 07:53:07 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 07:53:07 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <52A5CA60.2050403@owca.info>
References: <52A5CA60.2050403@owca.info>
Message-ID: <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>

On Mon, Dec 9, 2013 at 5:49 AM, Matej Kovacic <matej.kovacic at owca.info> wrote:
> http://secupwn.github.io/Android-IMSI-Catcher-Detector/


fun :)  i always liked osmocomBB, since openmoko days...

these days i prefer SDR and wider band, wider freq. transceivers, but
TI Calypso and MTK definitely more accessible!  will you provide a
developer mailing list in addition to github?


best regards,




From coderman at gmail.com  Mon Dec  9 08:07:18 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 08:07:18 -0800
Subject: EM-nature (was: infra-org)
In-Reply-To: <20131209050153.F147CF1DE@a-pb-sasl-quonix.pobox.com>
References: <CADhsnxcnUiaWWsgAa2kDUEyeqS=+kmG88TqN_Ph6m0nhPc0WSg@mail.gmail.com>
 <20131209050153.F147CF1DE@a-pb-sasl-quonix.pobox.com>
Message-ID: <CAJVRA1SPtShkTco9Fun-=LQ4zi50G6CdZMq+rXnqVk2NMk_QAA@mail.gmail.com>

On Sun, Dec 8, 2013 at 9:01 PM, Bill Stewart <bill.stewart at pobox.com> wrote:
> ...
> The shielding was basically plywood with sheet metal on both sides,
> with special metal joints in between them and on the corners,
> packed with wire mesh in the joints to plug any extra leaks,
> making a nice big Faraday cage.  The air vents were metal grates
> an inch or two deep with zig-zaggy airflow paths,
> and our data connections used fiber optics going through
> waveguide holes that were about 3" long and 1/8" diameter.
> Power feeds used big inductive low-pass filters.


effective attenuation of emanations above 10Ghz would be interesting.
even at >5Ghz you run into trouble with the AC filer route as you
mention; best practice seems to be DC batteries inside the cage :/

attenuation at high frequencies for air flow mesh less problematic;
optical communication links will always be useful of course...

i would be curious to see high dBm with high dBi gain
emitters(antennas) worst-case testing against actual build outs at
>5Ghz, as many designs aim for ~50dB attenuation with 120 (!!!) being
beyond exceptional..

Teletronics makes some nice 1W 5.8Ghz amps for 802.11a which could be
so purposed inexpensively.


best regards,




From coderman at gmail.com  Mon Dec  9 09:49:49 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 09:49:49 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
Message-ID: <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>

On Mon, Dec 9, 2013 at 8:51 AM, Travis Biehn <tbiehn at gmail.com> wrote:
> It looks like it doesn't function as a 'detector' yet?

it doesn't "function" yet, period.  *grin*

i leave it as an exercise for the reader to implement A0 detection on Android...




From tbiehn at gmail.com  Mon Dec  9 08:51:10 2013
From: tbiehn at gmail.com (Travis Biehn)
Date: Mon, 9 Dec 2013 11:51:10 -0500
Subject: Android IMSI Catcher detection
In-Reply-To: <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
Message-ID: <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>

It looks like it doesn't function as a 'detector' yet?


On Mon, Dec 9, 2013 at 10:53 AM, coderman <coderman at gmail.com> wrote:

> On Mon, Dec 9, 2013 at 5:49 AM, Matej Kovacic <matej.kovacic at owca.info>
> wrote:
> > http://secupwn.github.io/Android-IMSI-Catcher-Detector/
>
>
> fun :)  i always liked osmocomBB, since openmoko days...
>
> these days i prefer SDR and wider band, wider freq. transceivers, but
> TI Calypso and MTK definitely more accessible!  will you provide a
> developer mailing list in addition to github?
>
>
> best regards,
>



-- 
Twitter <https://twitter.com/tbiehn> |
LinkedIn<http://www.linkedin.com/in/travisbiehn>|
GitHub <http://github.com/tbiehn> | TravisBiehn.com<http://www.travisbiehn.com>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1352 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131209/dee85fdd/attachment.txt>

From matej.kovacic at owca.info  Mon Dec  9 05:49:20 2013
From: matej.kovacic at owca.info (Matej Kovacic)
Date: Mon, 09 Dec 2013 14:49:20 +0100
Subject: Android IMSI Catcher detection
Message-ID: <52A5CA60.2050403@owca.info>

More info here:

http://secupwn.github.io/Android-IMSI-Catcher-Detector/	

P. S. Developers needed. :-)


Regards,

M.




From coderman at gmail.com  Mon Dec  9 15:03:57 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 15:03:57 -0800
Subject: good clocks (not using GPS) and multi-channel hw [was: sidebands
 of great justice]
In-Reply-To: <CAJVRA1SGJibVOerV2ja6Fo=bwT5zRMjss1mFOkL9OMMjZagGLg@mail.gmail.com>
References: <CAJVRA1RcrPoxgBvOM5hSE+kqJRV0vmajTVLSWqPDCamgEDu0Yg@mail.gmail.com>
 <20131108195040.GL18544@hexapodia.org>
 <CAJVRA1SGJibVOerV2ja6Fo=bwT5zRMjss1mFOkL9OMMjZagGLg@mail.gmail.com>
Message-ID: <CAJVRA1Twu3SP10oVdim02VSW8_qrbL_XyB-+AZkRsnQZiBperA@mail.gmail.com>

On Fri, Nov 8, 2013 at 12:04 PM, coderman <coderman at gmail.com> wrote:
> ...
> correct. a common answer to inexpensive high quality clock is to pass
> the buck to GPS; this is explicitly not suitable, hence the
> qualifier.


GPS disciplining to keep a OCXO in check periodically (GPSDO) would be
useful!  GPS just can't be the primary source.

has anyone used an OctoClock-G?
  https://www.ettus.com/product/details/OctoClock-G


best regards,




From coderman at gmail.com  Mon Dec  9 15:17:04 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 15:17:04 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <52A62F25.3030205@owca.info>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
Message-ID: <CAJVRA1R2WgoWY6yStiQYUanVP1bt6x2YjcUdz+FFEcFiJFZrdA@mail.gmail.com>

On Mon, Dec 9, 2013 at 12:59 PM, Matej Kovacic <matej.kovacic at owca.info> wrote:
> ...
> Unfortunaltely I have no idea how to implement detection of A5/x
> ciphering used or detection of silent SMS'es on Android. However, it is
> very simple on Osmocom platform.


carrierIQ is good for something ;)

you're going to have to go ARM native (or ?) to observe use of A0 over
GSM, since android.telephony.gsm screwed us.



> I have also found out how to completely fake traffic data (data
> retention anyone :-)) ) and even how to insert arbitrary voice recording
> into eavesdropping database (in case police is eavesdropping to some
> mobile phone). Nice to know how "strong" could be computer generated
> evidence...

this came up on the cryptome list last week: camouflage, jamming,
obfuscation are all useful techniques to apply against unwelcome
observers. c.f. high power infra red LED camera dazzlers and LADAR
jammers, etc.

while equally effective on the cell bands, you'll want to be sure to
check your 20 before emitting with gusto!  ;P


best regards,




From coderman at gmail.com  Mon Dec  9 15:30:31 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 15:30:31 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
Message-ID: <CAJVRA1TRTp6QyZPsr4jN88AsNZUWp-Ag9G2hn6aTExrteSXKMg@mail.gmail.com>

On Mon, Dec 9, 2013 at 2:31 PM, Cathal Garvey (Phone)
<cathalgarvey at cathalgarvey.me> wrote:
> IDD, I've searched for an Android API for detecting crypto algo for ages and
> turned up empty.

i feel your pain...

(~_~;)



> However, you can get the tower ID, so a distributed,
> communally (cantenna?) verified whitelist of 'good' towers is doable, with
> automatic disconnection if an unwhitelisted tower connects..?

sort of; there are some interesting attacks using a force-pushed
silent PRL update (see DC19/DC20 cell attacks threads) which would be
observable by tower ID oddities, not to mention decremented or zero
PRL version.  however, you'd have to be paying attention (who checks
their PRL regularly? :).

if you simply check if a tower is in
http://www.opencellid.org/cell/list for example, you're open to
attacks spoofing a legitimate but remote (out of range) tower.

using direction finding techniques to cross reference the transmitter
location against the expected GPS coordinates in a tower database
relative to your position would also detect these tower impersonators,
but requires more hardware than a mobile baseband...



> Can/do IMSI systems spoof tower id: is there anything in GSM to make towers
> self-verifying? I'm guessing no, in which the above would be very poor.

the expensive, limited distribution kit will be hard to distinguish
without a high performance software defined radio.  if you're able to
detect an identically spoofed tower using OsmocomBB with high
confidence i'd love to know how you did it!



> Also of note is API for signal strength, so a mapping of known towers to
> expected strength at location XYZ could be used to detect systems used to
> home in on phones, which usually max out on signal and tell your phone to do
> likewise. Indeed, a strong signal tower which still asks your phone to dial
> up the juice should be regarded as an attack.

truth.  also, an inversion of observed data link capacity (suddenly
seeing receive bandwidth drop in half or more while transmit rate
doubles) is no bueno.


best regards,




From coderman at gmail.com  Mon Dec  9 16:22:38 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 16:22:38 -0800
Subject: Open phones for privacy/anonymity applications, Guardian
In-Reply-To: <20131209233218.816EE2280C6@palinka.tinho.net>
References: <78A88087-DAFD-4FE9-84C7-E17B2E1D82FF@gmail.com>
 <20131209233218.816EE2280C6@palinka.tinho.net>
Message-ID: <CAJVRA1R9Pz7jixF4CfFuGAy7j6dNhznv7obUUxvAuJSuEGJk_w@mail.gmail.com>

On Mon, Dec 9, 2013 at 3:32 PM,  <dan at geer.org> wrote:
> ...
> I lightly consulted with an operator and all he/she could
> offer was "Does Alexey mean the source to A5?" so I'll have
> to ask what it is that cannot be legally used in the U.S.?
> Anybody can implement and then open source any of the GSM
> standards (other than the crypto) so far as I know.


the FCC/NTIA don't like people using spectrum with unapproved devices.

sure, you can code it up. and sure, you can run an SDR in that range.

... but put them together in the wild at useful dBi and you're
stepping on toes.  try to sell/distribute such a setup? better have it
certified!

good analysis of the details:
  http://www.softwarefreedom.org/resources/2007/fcc-sdr-whitepaper.html
"""
...the FCC’s ancillary jurisdiction cannot reasonably extend to the
development of software by parties uninvolved in the marketing or sale
of radio devices...

FCC Rules for SDR Device Certification Only Affect Radio Equipment
Manufacturers...
"""




From coderman at gmail.com  Mon Dec  9 16:26:45 2013
From: coderman at gmail.com (coderman)
Date: Mon, 9 Dec 2013 16:26:45 -0800
Subject: Open phones for privacy/anonymity applications, Guardian
In-Reply-To: <CAJVRA1R9Pz7jixF4CfFuGAy7j6dNhznv7obUUxvAuJSuEGJk_w@mail.gmail.com>
References: <78A88087-DAFD-4FE9-84C7-E17B2E1D82FF@gmail.com>
 <20131209233218.816EE2280C6@palinka.tinho.net>
 <CAJVRA1R9Pz7jixF4CfFuGAy7j6dNhznv7obUUxvAuJSuEGJk_w@mail.gmail.com>
Message-ID: <CAJVRA1SDOd6sQ-HC6DEPYwrADz2jvG8EJFTU1bbMbYDmBYPP1g@mail.gmail.com>

On Mon, Dec 9, 2013 at 4:22 PM, coderman <coderman at gmail.com> wrote:
> ... better have it certified!

to be specific: it is this certification step that fully open source
SDR/baseband equipment manufacturers have difficultly with.  E.g. the
FCC plainly states systems  "wholly dependent on open source elements”
would have a “high burden” to demonstrate their security during the
certification process.  where many have taken "high burden" to mean
"nearly impossible"...


best regards,




From dan at geer.org  Mon Dec  9 15:32:18 2013
From: dan at geer.org (dan at geer.org)
Date: Mon, 09 Dec 2013 18:32:18 -0500
Subject: Open phones for privacy/anonymity applications, Guardian
In-Reply-To: Your message of "Tue, 05 Nov 2013 12:50:11 +0400."
 <78A88087-DAFD-4FE9-84C7-E17B2E1D82FF@gmail.com>
Message-ID: <20131209233218.816EE2280C6@palinka.tinho.net>


 > GSM firmware is still not open-source though (as that would make phone
 > not suitable for legal usage in USA)

I lightly consulted with an operator and all he/she could
offer was "Does Alexey mean the source to A5?" so I'll have
to ask what it is that cannot be legally used in the U.S.?
Anybody can implement and then open source any of the GSM
standards (other than the crypto) so far as I know.

--dan




From adi at hexapodia.org  Mon Dec  9 18:55:21 2013
From: adi at hexapodia.org (Andy Isaacson)
Date: Mon, 9 Dec 2013 18:55:21 -0800
Subject: Open phones for privacy/anonymity applications, Guardian
In-Reply-To: <20131209233218.816EE2280C6@palinka.tinho.net>
References: <78A88087-DAFD-4FE9-84C7-E17B2E1D82FF@gmail.com>
 <20131209233218.816EE2280C6@palinka.tinho.net>
Message-ID: <20131210025520.GE3524@hexapodia.org>

On Mon, Dec 09, 2013 at 06:32:18PM -0500, dan at geer.org wrote:
> > GSM firmware is still not open-source though (as that would make phone
> > not suitable for legal usage in USA)
> 
> I lightly consulted with an operator and all he/she could
> offer was "Does Alexey mean the source to A5?" so I'll have
> to ask what it is that cannot be legally used in the U.S.?
> Anybody can implement and then open source any of the GSM
> standards (other than the crypto) so far as I know.

I believe that there's no law or regulation preventing anyone from
writing open source implementations of GSM in the US.

However there definitely are regulations preventing the sale or
operation of unlicensed intentional emitters, and the FCC definitely
cares about the GSM bands.  Getting a license for an open source
implementation of GSM would likely be a large expense, which AFAIK no
open source implementor has even started to try to undertake.

There is also federal law prohibiting the sale of equipment which can
intercept wireless telephony communications.  Many scanners have
filters or programming/configuration jumpers which prevent reception of
the specific frequencies covered by the law.  Depending on the reading
and the zealousness of the prosecutor, such a law might be seen to be
relevant to an open source GSM platform.

-andy




From matej.kovacic at owca.info  Mon Dec  9 12:59:17 2013
From: matej.kovacic at owca.info (Matej Kovacic)
Date: Mon, 09 Dec 2013 21:59:17 +0100
Subject: Android IMSI Catcher detection
In-Reply-To: <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
References: <52A5CA60.2050403@owca.info>	<CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>	<CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
Message-ID: <52A62F25.3030205@owca.info>

Hi,

> it doesn't "function" yet, period.  *grin*
> 
> i leave it as an exercise for the reader to implement A0 detection on Android...
Unfortunaltely I have no idea how to implement detection of A5/x
ciphering used or detection of silent SMS'es on Android. However, it is
very simple on Osmocom platform.

Anyway, IMSI Catcher detection project needs developers.

P. S. A little more info about GSM hacking is here:
http://matej.owca.info/predavanja/GSM_security_2012.pdf
We also have some nice videos showing identity theft in GSM network... :-))

I have also found out how to completely fake traffic data (data
retention anyone :-)) ) and even how to insert arbitrary voice recording
into eavesdropping database (in case police is eavesdropping to some
mobile phone). Nice to know how "strong" could be computer generated
evidence...

Regards,

M.




From cathalgarvey at cathalgarvey.me  Mon Dec  9 14:31:11 2013
From: cathalgarvey at cathalgarvey.me (Cathal Garvey (Phone))
Date: Mon, 09 Dec 2013 22:31:11 +0000
Subject: Android IMSI Catcher detection
In-Reply-To: <52A62F25.3030205@owca.info>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
Message-ID: <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>

IDD, I've searched for an Android API for detecting crypto algo for ages and turned up empty. However, you can get the tower ID, so a distributed, communally (cantenna?) verified whitelist of 'good' towers is doable, with automatic disconnection if an unwhitelisted tower connects..?

Can/do IMSI systems spoof tower id: is there anything in GSM to make towers self-verifying? I'm guessing no, in which the above would be very poor.

Also of note is API for signal strength, so a mapping of known towers to expected strength at location XYZ could be used to detect systems used to home in on phones, which usually max out on signal and tell your phone to do likewise. Indeed, a strong signal tower which still asks your phone to dial up the juice should be regarded as an attack.

Matej Kovacic <matej.kovacic at owca.info> wrote:
>Hi,
>
>> it doesn't "function" yet, period.  *grin*
>> 
>> i leave it as an exercise for the reader to implement A0 detection on
>Android...
>Unfortunaltely I have no idea how to implement detection of A5/x
>ciphering used or detection of silent SMS'es on Android. However, it is
>very simple on Osmocom platform.
>
>Anyway, IMSI Catcher detection project needs developers.
>
>P. S. A little more info about GSM hacking is here:
>http://matej.owca.info/predavanja/GSM_security_2012.pdf
>We also have some nice videos showing identity theft in GSM network...
>:-))
>
>I have also found out how to completely fake traffic data (data
>retention anyone :-)) ) and even how to insert arbitrary voice
>recording
>into eavesdropping database (in case police is eavesdropping to some
>mobile phone). Nice to know how "strong" could be computer generated
>evidence...
>
>Regards,
>
>M.

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2357 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131209/859019d8/attachment.txt>

From matej.kovacic at owca.info  Tue Dec 10 02:56:39 2013
From: matej.kovacic at owca.info (Matej Kovacic)
Date: Tue, 10 Dec 2013 11:56:39 +0100
Subject: Android IMSI Catcher detection
In-Reply-To: <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
Message-ID: <52A6F367.3000909@owca.info>

Hi,

> Can/do IMSI systems spoof tower id: is there anything in GSM to make
> towers self-verifying? I'm guessing no, in which the above would be very
> poor.
No, the problem is, that mobile phone authenticates to mobile network,
but the opposite is not true. Since mobile network does not authenticate
itself to mobile phone, IMSI Catcher attacks are possible.

There has been also demonstration of "home-made" IMSI Catcher based on
Osmocom platform last year at the CCC conference.

The video of the presentation "Further hacks on the Calypso platform" by
Sylvain Munaut is here:
http://media.ccc.de/browse/congress/2012/29c3-5226-en-further_hacks_calypso_h264.html

So, it is very easy to set up fake cell with any cell ID.

> Also of note is API for signal strength, so a mapping of known towers to
> expected strength at location XYZ could be used to detect systems used
> to home in on phones, which usually max out on signal and tell your

This would not work, because cells are not static (new cell emerge,
covered area changes, etc.) and opencellid database is not regularly
updated. There could also be femtocells used, etc...


Regards,

M.




From azet at azet.org  Tue Dec 10 05:06:18 2013
From: azet at azet.org (Aaron Zauner)
Date: Tue, 10 Dec 2013 14:06:18 +0100
Subject: Android IMSI Catcher detection
In-Reply-To: <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
Message-ID: <29AB289E-3754-4D81-92D6-0A6B9DAE2231@azet.org>

Hi *,

This might be of interest to you guys: https://opensource.srlabs.de/projects/catcher/wiki

Cheers,
azet
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1091 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131210/92af3e4b/attachment.sig>

From coderman at gmail.com  Wed Dec 11 00:09:49 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 00:09:49 -0800
Subject: Fwd: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1SvXkgOz7NZz7DWXqNo3KJWQtoENXzcCcNzspXWnLYovw@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1SvXkgOz7NZz7DWXqNo3KJWQtoENXzcCcNzspXWnLYovw@mail.gmail.com>
Message-ID: <CAJVRA1SDYrsg3EtTzVx8ziAqtKuMAxiDNEGv1FuGTMGnOERJuQ@mail.gmail.com>

---------- Forwarded message ----------
From: coderman <coderman at gmail.com>
Date: Tue, Dec 10, 2013 at 7:12 PM
Subject: Re: [cryptography] Which encryption chips are compromised?

On Tue, Dec 10, 2013 at 4:11 PM,  <dan at geer.org> wrote:
> ...
> For this to be an explicit line item in that document, it
> has to be special.  The two classes of "special" that occur
> to me are (1) XXXXXX has a near monopoly (like Broadcom
> does in its sector) or (2) XXXXXX is uniquely vulnerable to
> blackmail (a merchant with an export control problem, say).

you ask interesting questions Dan, and draw useful conclusions :)

some items to note:
- is this DUAL_EC_DRNG? don't think so. deadline is FY 2013.
- is this DUAL_EC_DRNG? the market for closed source, proprietary
crypto solutions is small (and growing smaller, :(
- is this XSTORE? it's been a while. but never should have been used
directly. see mtrngd with MSR bits set no whitening, max sample, max
freq. into mix + conservative estimate before /dev/random write.



> But in related news:
>
> Engineers abandon encryption chips after Snowden leaks
> http://rt.com/usa/snowden-leak-rng-randomness-019/

some cryptographers and cypherpunks have become despondent or dejected
or demoralized by these events.

i see a larger picture: never before have so many been doing crypto less wrong!

;P




From coderman at gmail.com  Wed Dec 11 00:10:24 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 00:10:24 -0800
Subject: Fwd: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel and
 Via's chip-based crypto, FreeBSD developers say
In-Reply-To: <52A78712.8000801@gmail.com>
References: <E871618D-B334-4C34-963F-9B1D88A3DDC4@warpspeed.com>
 <227BEBDF-7DDF-4CE2-92E8-F6D3CF274E58@gmail.com>
 <CANog7L5KN+Kn3OOBW8BXZTw6pR0x4VEfCjxYq7OeB5sv=aui8w@mail.gmail.com>
 <52A78712.8000801@gmail.com>
Message-ID: <CAJVRA1TqHf+uwVShR2MQGQE-t7iAtSDrkW1agF_n2-aOpPVy3g@mail.gmail.com>

---------- Forwarded message ----------
From: Bill Cox <waywardgeek at gmail.com>
Date: Tue, Dec 10, 2013 at 1:26 PM
Subject: Re: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel
and Via's chip-based crypto, FreeBSD developers say
To: cryptography at metzdowd.com


I think there may be weaknesses in Intel's hardware RNG.  I took a
good look at Intel's hardware random number generator source. There's
a paper analyzing it here:

http://www.cryptography.com/public/pdf/Intel_TRNG_Report_20120312.pdf

The basic idea is that back-to-back inverters, when powered on, flip
one way or the other randomly, sort of like DRAM memory when our
computer's power on.  By powering on a single pair of back-to-back
inverters over and over, they can generate a random bit per cycle, at
about 3 Giga-bits/second, which is amazing!  Here's my concerns about
the the paper:

- I saw no mathematical analysis of how much noise exists in the
system and how strongly it will influence the result each cycle. There
were generalities about how the noise could cause the output to be
random, but no numbers at all.
- There is an assumption that the capacitors are charged/discharged by
10% of the standard deviation of the noise.  I saw no justification
for this.  It seems they simply assumed best case.
- The paper is about as objective as a mother talking about her
children.  For example: "Overall, the Ivy Bridge RNG is a robust
design with a large margin of safety that ensures good random data is
generated even if the ES is not operating as well as predicted." Based
on what?
- I am not convinced they have the right model for the entropy source.
 They add noise to the bias on the capacitors, and compare that to 0
to determine the next output bit in their model.  I think the main
source of noise may be the randomness in number of electrons
added/subtracted each cycle, and that the back-to-back inverters in
the absence of other noise may be acting almost as an ideal
comparator.  However, if this were the case, even if there were 10%
noise in the number of electrons, there would be considerable
correlation between bits.

I also have questions about the design itself.  My main concern is
that noise on the VDD rail could easily determine the output.  For
example, if the transistors are mismatched, which of course they will
be, and the bias is set exactly right on the caps so there's a 50-50
chance of a 0 or 1, and suddenly VDD drops 10% due to a rising edge of
the the main system clock, then the inverter with higher gate
thresholds will become weak faster than the other one, thus
determining which one wins.  Since this circuit runs asynchronously
from the main system clock, I could easily see the 3MHz system clock
phase relative to the entropy generator clock determining most of the
results from the entropy source, while looking fairly random. Any
weakness in the raw random data stream is hidden from us by the AES
encryption done as a post-process.

I simulated back-to-back inverters in my .35u low power CMOS process
in SPICE to see if I could figure out how to make a practical circuit
using Intel's topology.  If it works, it would be fantastic.  I think
I can get rid of most of the supply noise issues.  I had a similar
problem in my "Infinite Noise Multiplier", so I switched to powering
the circuit with nothing but large W and L constant current sources,
and using the range from 0V to Vref, rather than 0V to VDD, because
Vref is stable relative to AVSS. However, I wasn't able to get enough
noise to make Intel's ciruit work, though that may be due to
limitations in the SPICE simulator.

Has anyone else had success using Intel's RNG topology?




From coderman at gmail.com  Wed Dec 11 00:10:52 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 00:10:52 -0800
Subject: Fwd: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel and
 Via's chip-based crypto, FreeBSD developers say
In-Reply-To: <52A7AA6B.3050300@gmail.com>
References: <E871618D-B334-4C34-963F-9B1D88A3DDC4@warpspeed.com>
 <227BEBDF-7DDF-4CE2-92E8-F6D3CF274E58@gmail.com>
 <CANog7L5KN+Kn3OOBW8BXZTw6pR0x4VEfCjxYq7OeB5sv=aui8w@mail.gmail.com>
 <CAHWD2rKjFLYOvs4QdcovVfG2O=r6O7+efxgXgHRY6WXjObVA0w@mail.gmail.com>
 <52A7AA6B.3050300@gmail.com>
Message-ID: <CAJVRA1Q_P1jJV8eDh1N72g8Fdp6O+TWWyDchzrOhU6_8EuLdUA@mail.gmail.com>

---------- Forwarded message ----------
From: Bill Cox <waywardgeek at gmail.com>
Date: Tue, Dec 10, 2013 at 3:57 PM
Subject: Re: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel
and Via's chip-based crypto, FreeBSD developers say
To: cryptography at metzdowd.com


I have to take back my criticism of Intel's RNG.  I got my sims
working for a version of their architecture in .35u CMOS, and it's
simply better than my "Infinite Noise Multiplier".  It's probably the
best true random noise generator ever.  I still don't like how their
schematic is seems highly sensitive to supply noise, but we don't know
what the actual circuit looks like.  Intel hasn't told us.

So, I'm going to modify it a bit to use the resistors available on my
chip and reduce the caps, fix the supply sensitivity, and I think I
can run 16 of these things in parallel at 100-200MHz on the tiny .35u
CMOS chip I'm designing.  I'll spit out the raw waveforms from the
inverters, buffered once, through 16 "analog" pins, so there wont be
any fear (hopefully) that I'm cooking the data on-chip, before you can
see it, and I'll open-source the schematics.  If there's a circuit
that can consume all 1.6Gbit/sec of this raw data, have fun with it!
On the digital side, I'll XOR bits together to get the bandwidth down
to something reasonable, which I can send over USB, and provide a
simple Linux driver.

This thing will definitely put out RF, but since I'm making the raw
data available at the pins, should I care?  By the way, this is just a
for-fun project at work.  I get to do a free chip design :-)




From coderman at gmail.com  Wed Dec 11 00:11:18 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 00:11:18 -0800
Subject: Fwd: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel and
 Via's chip-based crypto, FreeBSD developers say
In-Reply-To: <CAJVRA1TzrT9gDmZ=kWcVEGoiRBW+Ue9LVccLo1SOn8i-2nFqmw@mail.gmail.com>
References: <E871618D-B334-4C34-963F-9B1D88A3DDC4@warpspeed.com>
 <227BEBDF-7DDF-4CE2-92E8-F6D3CF274E58@gmail.com>
 <CANog7L5KN+Kn3OOBW8BXZTw6pR0x4VEfCjxYq7OeB5sv=aui8w@mail.gmail.com>
 <CAHWD2rKjFLYOvs4QdcovVfG2O=r6O7+efxgXgHRY6WXjObVA0w@mail.gmail.com>
 <52A7AA6B.3050300@gmail.com>
 <CAJVRA1TzrT9gDmZ=kWcVEGoiRBW+Ue9LVccLo1SOn8i-2nFqmw@mail.gmail.com>
Message-ID: <CAJVRA1RgxBVXU1Oonzyx8-OrDa6YDcbv6zpOva6-RnRXUVygQA@mail.gmail.com>

---------- Forwarded message ----------
From: coderman <coderman at gmail.com>
Date: Wed, Dec 11, 2013 at 12:06 AM
Subject: Re: [zs-p2p] [Cryptography] Fwd: [IP] 'We cannot trust' Intel
and Via's chip-based crypto, FreeBSD developers say
To: zs-p2p at zerostate.is


On Tue, Dec 10, 2013 at 3:57 PM, Bill Cox <waywardgeek at gmail.com> wrote:
> ...
> So, I'm going to modify it a bit to use the resistors available on my chip
> and reduce the caps, fix the supply sensitivity, and I think I can run 16 of
> these things in parallel at 100-200MHz on the tiny .35u CMOS chip I'm
> designing.  I'll spit out the raw waveforms from the inverters, buffered
> once, through 16 "analog" pins, so there wont be any fear (hopefully) that
> I'm cooking the data on-chip, before you can see it, and I'll open-source
> the schematics.  If there's a circuit that can consume all 1.6Gbit/sec of
> this raw data, have fun with it!


raw samples at 1.6Gb/s would be useful infrequently[0]; raw samples
from a trusted device extremely useful at any bitrate!

what is "my chip" and how can we find out more / support your efforts?


best regards,


0. to date i have only maxed out 400Mb/s raw VIA Padlock sources for
SSD FDE initialization and constructed experiments in temporal key
rolling.  it is however common to regularly consume on the order of
10Mb/s on a busy server, generating many keys, using crypto happy
software, etc.  (this is why every processor, every embedded device
should have a physical entropy source, with access to raw samples.
still waiting...)




From coderman at gmail.com  Wed Dec 11 07:17:09 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 07:17:09 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <52A877FA.9090901@disman.tl>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
 <52A6F367.3000909@owca.info> <52A877FA.9090901@disman.tl>
Message-ID: <CAJVRA1SRcLxTEZMdTC2gjR5cR-uMKkwgb2vT=_ZivH8Z6i2c2w@mail.gmail.com>

On Wed, Dec 11, 2013 at 6:34 AM, Dan Staples <danstaples at disman.tl> wrote:
> This morning's NSA article from WaPo contains some slides mentioning
> USRP equipment[1]. It's hard to say without more context whether it's
> referring to the GSM equipment from Ettus...anyone care to speculate?
> The USRP series doesn't exactly seem like carrier-grade equipment, but
> perhaps the NSA has a good reason to use it.

the partnership with NGA to deploy them gives a hint: this is putting
USRPs up close and personal to target for exploitation.
(the USRP's are definitely more portable than my favorite SDR, the Noctar[0]!)

given the obtained bits mentioned (WLLids, DSL accounts, Cookies,
GooglePREFIDs) gathered and then handed off to TAO for further QUANTUM
INSERT fucking of target systems it is likely they are doing GSM/cell
MitM to observe identifiers, along with WiFi attacks, and other egress
rather than deploying baseband exploits or deep active attacks
directly against the devices or other networks they're communicating
with.

thus CNE in this case is cell MitM/WiFi pwn with a USRP rogue tower to
get identifiers for TAO.  and TAO is where they get dirty with "remote
exploitation" of the device itself and other targets on networks it
uses.

we've seen how they have a smorgasbord of weaponized exploits to cover
the gamut of target hardware and technical acumen in the QUANTUM
INSERT / TURMOIL / TRAFFICTHIEF / MUTANT BROTH / etc, etc. style
efforts.  it appears they're using this same infrastructure where
possible for mobile; restricting CNE on the ground only to target.

best regards,



0. Pervices Noctar
  http://www.pervices.com/support/




From coderman at gmail.com  Wed Dec 11 07:22:12 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 07:22:12 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <CAJVRA1SRcLxTEZMdTC2gjR5cR-uMKkwgb2vT=_ZivH8Z6i2c2w@mail.gmail.com>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
 <52A6F367.3000909@owca.info> <52A877FA.9090901@disman.tl>
 <CAJVRA1SRcLxTEZMdTC2gjR5cR-uMKkwgb2vT=_ZivH8Z6i2c2w@mail.gmail.com>
Message-ID: <CAJVRA1SQpfRgLt+TAmAkyG+NXzFa=xXNjgsRY8_zJNzrf3cewA@mail.gmail.com>

On Wed, Dec 11, 2013 at 7:17 AM, coderman <coderman at gmail.com> wrote:
> ...
> thus CNE in this case is cell MitM/WiFi pwn with a USRP rogue tower to
> get identifiers for TAO.  and TAO is where they get dirty with "remote
> exploitation" of the device itself and other targets ...


see also this section on the OPEC hacks:

http://arstechnica.com/information-technology/2013/11/quantum-of-pwnness-how-nsa-and-gchq-hacked-opec-and-others/
"""
Here’s how the NSA and GCHQ go after an organization like OPEC step by
step, based on an analysis of the NSA and GCHQ documents exposed by
Snowden:

Step 1: Identify. Using the NSA-built packet capture and inspection
system called TURMOIL, the agencies filter through Internet traffic at
a network choke point looking for specific "fingerprints" in traffic
that identify users with the organization being targeted. Data from
TURMOIL gets pulled into a number of traffic analysis tools, such as
XKeyscore and TRAFFICTHIEF, which do different sorts of packet
analysis.

XKeyscore is the NSA's distributed search engine, catching a large
chunk of international Internet traffic for analysis. It helps find
things deep in the clutter of the Internet that analysts might miss by
allowing them to use search terms to find things in both live and
cached Internet traffic.

TRAFFICTHIEF, on the other hand, is much more focused. It filters for
very "strong" indicators, like known sets of IP addresses, addresses
within e-mail traffic, or user names in logins to social networks or
other services. It provides less depth of analysis than XKeyscore, but
it can handle much larger loads of data because it is more selective
about what it processes.

Together, the tools can be used to identify the systems used by an
individual or organization, including ranges of addresses that they
may use from work or home.

Step 2: Target. Using the profiles built using the surveillance tools,
the agencies can then identify potential points of attack. XKeyscore,
for example, can be used to search for patterns that identify known
security vulnerabilities within a range of addresses. Web visit
histories, e-mail traffic, and other data are analyzed looking for the
most likely (and least detectable) approach to gain access, and a
specific attack plan is crafted, including the identification of where
to launch the attack from.

At the NSA, this sort of thing is the work of Tailored Access
Operations. In the case of OPEC, the targeting process apparently went
on for several years as the NSA sought openings for an attack.

Step 3: Attack. Depending on who the target is, the NSA and GCHQ have
a variety of options. The least costly is to use access provided by
one of the intelligence agencies' telecommunications "partners" who
own network equipment at an exchange or other choke point that the
target's Internet traffic passes through. The agency running the
attack can use that access to introduce changes to Internet routing
tables that detour the targeted individual's traffic. But in some
cases, the NSA and GCHQ may have to perform "unilateral" taps on
network backbones to gain that level of access—targeting a piece of
network hardware to take over or splicing directly into the target's
own connection to the Internet.

It's not clear which attack the NSA used to gain access to OPEC's
systems, though the GCHQ used a Quantum attack two years later to gain
its own very special access to the cartel's network. In the case of
the Belgacom hack, the GCHQ used a Quantum insert attack—routing the
Web requests for LinkedIn and Slashdot from the engineer being
targeted to a server posing as those sites. The NSA has used the same
approach to intercept traffic to sites such as Google.

The man-in-the-middle server can present content from the actual sites
the target intended to visit, but it can also add content to the
traffic, using what's called packet injection—modifying the contents
of the data as it passes through—and intercept the user's credentials.
And by using a forged certificate, the NSA can intercept encrypted
traffic intended for the destination site.

Once the user has connected to the fake server, the intelligence
agencies can use the connection to launch attacks against the target's
Web browser to install monitoring software or other malware, using
similar techniques to those used by hackers. They can also use
credentials exposed via the man-in-the-middle attack to gain access to
other accounts owned by the target and to troll through connections in
those services that might be potential targets.

Step 4: Exploit. Once the target's computer has been successfully
attacked, the effort begins to look much like that of the Chinese
cyber warriors' attack of the New York Times or what cyber criminals
typically do when they score access to high-value targets. The
agencies' hackers work to stealthily expand their level of access,
using customized remote administration tools to grab user privileges
and gain access to other network resources—mail servers, file servers,
and other network systems. They then start to "exfiltrate" data from
these systems and deliver them to analysts.
"""




From griffin at cryptolab.net  Wed Dec 11 07:39:28 2013
From: griffin at cryptolab.net (griffin at cryptolab.net)
Date: Wed, 11 Dec 2013 07:39:28 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <52A877FA.9090901@disman.tl>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
 <52A6F367.3000909@owca.info> <52A877FA.9090901@disman.tl>
Message-ID: <90ca1f172fa803bf546977a636f23af8@cryptolab.net>

Dan Staples ha scritto:
> Simply getting cell
> tower database dumps from the telcos would suffice for location info, 
> so
> I would guess this has a different purpose.

   The NSA doesn't seem to want to play by the typical LEA best 
practices. So they might not be willing to send a formal request for 
data on a particular party (lest it be leaked or the target find out).

   My bet is real-time call interception for high-value targets.  If 
ye-random security researcher can crack most GSM encryption and listen 
in or inject fake content with cheap hardware, then the NSA certainly 
has people who can make that happen as well (and with billions of 
dollars to throw at the problem).

~Griffin




From danstaples at disman.tl  Wed Dec 11 06:34:34 2013
From: danstaples at disman.tl (Dan Staples)
Date: Wed, 11 Dec 2013 09:34:34 -0500
Subject: Android IMSI Catcher detection
In-Reply-To: <52A6F367.3000909@owca.info>
References: <52A5CA60.2050403@owca.info>
 <CAJVRA1SuLqRwmwzRBMJ_hGv263VqqEko=o3JnEGTwGXD6q6xVQ@mail.gmail.com>
 <CAKtE3zf8ri1Ej1duwkXsYw_h2bHAj7KWwvojoANU45Ctm4VhFg@mail.gmail.com>
 <CAJVRA1QDC-sjTV0QxZd0q7Fw4UF7WRPKiOjFqqO0i-yqy2yq5A@mail.gmail.com>
 <52A62F25.3030205@owca.info>
 <2ff1d371-5c2e-4dda-b6af-3a0e84fe77d2@email.android.com>
 <52A6F367.3000909@owca.info>
Message-ID: <52A877FA.9090901@disman.tl>

This morning's NSA article from WaPo contains some slides mentioning
USRP equipment[1]. It's hard to say without more context whether it's
referring to the GSM equipment from Ettus...anyone care to speculate?
The USRP series doesn't exactly seem like carrier-grade equipment, but
perhaps the NSA has a good reason to use it. Maybe baseband
exploitation, as coderman has previously mentioned? Simply getting cell
tower database dumps from the telcos would suffice for location info, so
I would guess this has a different purpose.


[1]
http://apps.washingtonpost.com/g/page/national/nsa-signal-surveillance-success-stories/647/#document/p3/a135606

On 12/10/2013 05:56 AM, Matej Kovacic wrote:
> Hi,
> 
>> Can/do IMSI systems spoof tower id: is there anything in GSM to make
>> towers self-verifying? I'm guessing no, in which the above would be very
>> poor.
> No, the problem is, that mobile phone authenticates to mobile network,
> but the opposite is not true. Since mobile network does not authenticate
> itself to mobile phone, IMSI Catcher attacks are possible.
> 
> There has been also demonstration of "home-made" IMSI Catcher based on
> Osmocom platform last year at the CCC conference.
> 
> The video of the presentation "Further hacks on the Calypso platform" by
> Sylvain Munaut is here:
> http://media.ccc.de/browse/congress/2012/29c3-5226-en-further_hacks_calypso_h264.html
> 
> So, it is very easy to set up fake cell with any cell ID.
> 
>> Also of note is API for signal strength, so a mapping of known towers to
>> expected strength at location XYZ could be used to detect systems used
>> to home in on phones, which usually max out on signal and tell your
> 
> This would not work, because cells are not static (new cell emerge,
> covered area changes, etc.) and opencellid database is not regularly
> updated. There could also be femtocells used, etc...
> 
> 
> Regards,
> 
> M.
> 

-- 
http://disman.tl
OpenPGP key: http://disman.tl/pgp.asc
Fingerprint: 2480 095D 4B16 436F 35AB 7305 F670 74ED BD86 43A9




From coderman at gmail.com  Wed Dec 11 14:08:46 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 14:08:46 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <20131211200728.5D5872280F4@palinka.tinho.net>
References: <CAJVRA1SQpfRgLt+TAmAkyG+NXzFa=xXNjgsRY8_zJNzrf3cewA@mail.gmail.com>
 <20131211200728.5D5872280F4@palinka.tinho.net>
Message-ID: <CAJVRA1S5LYNzvU8fS7VqxcuOJ+oh24sgpyY9JnaJd4_8+WxAoA@mail.gmail.com>

On Wed, Dec 11, 2013 at 12:07 PM,  <dan at geer.org> wrote:
> ... is the kind
> of remote penetration of potential enemies by technical means, such
> as coderman postulated at length, closer to politics or closer to
> war?  Or, in current argot, is it closer to cyberpolitics or closer
> to cyberwar?


CNE+TAO as non destructive espionage (politics)
  but they also play
CNE+TAO as kinetic force multiplier (war)


so the answer is: both!  depending on the target...




From dan at geer.org  Wed Dec 11 12:07:28 2013
From: dan at geer.org (dan at geer.org)
Date: Wed, 11 Dec 2013 15:07:28 -0500
Subject: Android IMSI Catcher detection
In-Reply-To: Your message of "Wed, 11 Dec 2013 07:22:12 PST."
 <CAJVRA1SQpfRgLt+TAmAkyG+NXzFa=xXNjgsRY8_zJNzrf3cewA@mail.gmail.com>
Message-ID: <20131211200728.5D5872280F4@palinka.tinho.net>


coderman writes
 >...
a lot.  Which I've elided...

As a vaguely snarky remark on my part, when one quotes von Clausewitz,
"War is the continuation of politics by other means," is the kind
of remote penetration of potential enemies by technical means, such
as coderman postulated at length, closer to politics or closer to
war?  Or, in current argot, is it closer to cyberpolitics or closer
to cyberwar?

See,

http://ecir.mit.edu/ (Office of Naval Research N00014-09-1-0597)

http://www.atlanticcouncil.org/publications/books/a-fierce-domain-conflict-in-cyberspace-1986-to-2012 (viz., book _Fierce Domain_)


--dan




From coderman at gmail.com  Wed Dec 11 18:00:50 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 18:00:50 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <20131211001137.892EA228094@palinka.tinho.net>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
Message-ID: <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>

On Tue, Dec 10, 2013 at 4:11 PM,  <dan at geer.org> wrote:
>  >     * (TS//SI//REL TO USA, FVEY) Complete enabling for [XXXXXX]
>  > encryption chips used in Virtual Private Network and Web encryption
>  > devices. [CCP_00009].
>
> For this to be an explicit line item in that document, it
> has to be special.


unredacted:
https://peertech.org/dist/nsa-cpp-goals-FY2013-unredact.png

"Intel Ivy Bridge"




From coderman at gmail.com  Wed Dec 11 18:04:39 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 18:04:39 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
Message-ID: <CAJVRA1QTN4p67VO3VOJ9YUHMux7R5=YM8BDGcRNdCemXo2ihqw@mail.gmail.com>

On Wed, Dec 11, 2013 at 6:00 PM, coderman <coderman at gmail.com> wrote:
> ...
> "Intel Ivy Bridge"


http://en.wikipedia.org/wiki/Ivy_Bridge_(microarchitecture)
"""
Ivy Bridge is the codename for a line of processors based on the 22 nm
manufacturing process developed by Intel. The name is also applied
more broadly to the 22 nm die shrink of the Sandy Bridge
microarchitecture based on FinFET ("3D") tri-gate transistors, which
is also used in the Xeon andCore i7 Ivy Bridge-EX (Ivytown), Ivy
Bridge-EP and Ivy Bridge-E microprocessors released in 2013.
"""




From coderman at gmail.com  Wed Dec 11 18:16:07 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 18:16:07 -0800
Subject: Android IMSI Catcher detection
In-Reply-To: <CAJVRA1S5LYNzvU8fS7VqxcuOJ+oh24sgpyY9JnaJd4_8+WxAoA@mail.gmail.com>
References: <CAJVRA1SQpfRgLt+TAmAkyG+NXzFa=xXNjgsRY8_zJNzrf3cewA@mail.gmail.com>
 <20131211200728.5D5872280F4@palinka.tinho.net>
 <CAJVRA1S5LYNzvU8fS7VqxcuOJ+oh24sgpyY9JnaJd4_8+WxAoA@mail.gmail.com>
Message-ID: <CAJVRA1Qpgy693DdZVAzw35NeSBJ6n=vHWc3X7YMSkDeHfcVimA@mail.gmail.com>

Regarding the CCP FY 2013 goals per
https://peertech.org/dist/nsa-cpp-goals-FY2013-unredact.png,

"Make gains in enabling decryption and Computer Network Exploitation
(CNE) access to fourth generation/Long Term Evolution (4G/LTE)
networks via enabling. [CCP_00009]"


i wonder if they upgraded to N210 (pairs?) for good 4G/LTE performance?
  https://www.ettus.com/product/details/UN210-KIT




From coderman at gmail.com  Wed Dec 11 19:01:31 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 19:01:31 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
Message-ID: <CAJVRA1TEUo3K6O=rii-iH6X6_Dw9UDA0Jz5mL6pamTEC7p+o=Q@mail.gmail.com>

On Wed, Dec 11, 2013 at 6:28 PM, Steve Weis <steveweis at gmail.com> wrote:
> ...
> Ivy Bridge processors are general purpose x86 CPUs. It doesn't make sense to
> me to refer to it as an "encryption chip" for "web encryption devices".

"used in Virtual Private Network" == PPTP,IPsec,OpenVPN,etc.

"Web encryption devices" == in my interpretation, this is any targeted
hardware with the vulnerable chip.  it could be a tablet, a desktop,
and rack mount server...  any of these platforms could speak VPN or
Web crypto.  TAO/SCS do like to get into the switches though ;)


> Do
> you know of products using IVB processors for SSL offloading or in VPN
> appliances?

mostly "cloud infrastructure", "software defined data center", and the like:
http://www.routeranalysis.com/the-vyatta-cloud-router-story/
http://www.routeranalysis.com/etsi-network-function-virtualization-working-group/



> To me, the redacted document sounds like it's referring to a security
> processor used for SSL offloading. For example, something like a Cavium
> Nitrox (which I'm not implying is the subject of the document).

back in the day, Sun got tired of the (relatively) slow performance
and latency of crypto offloading via bus and simply threw it into the
core.  you were still offloading crypto, but within the CPU.

also note that endpoint compromises sufficient to decrypt VPN or
secure web traffic is already present in TAO/CNE's tasking.  this
effort [CCP_00009] may focus on VPN concentrator / secure web proxy
deployments specifically to handle the RDRAND lookup per their private
starting counter.

previous back doors have also used entropy leakage sufficient to bring
a brute force attack into reasonable effort, while still denying third
parties a class break of the entropy / keys used.  this type of key
space search is not done on the ground with portable CNE but instead
back at SCS...


on a related tangent, the lack of additional disclosures is quite
frustrating.  this entire conversation would be resolved in a glance
if $the_snowden_gatekeepers were acting in the public interest.  :/

best regards,




From juan.g71 at gmail.com  Wed Dec 11 15:42:53 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Wed, 11 Dec 2013 20:42:53 -0300
Subject: Tradeoffs in Cyber Security
Message-ID: <36EBF5782B0B75E037276B96@F74D39FA044AA309EAEA14B9>


http://geer.tinho.net/geer.uncc.9x13.txt

"The essential character of a free society is this: That which is
not forbidden is permitted." 

That's a useless tautology. The essential character of a free society is
unconditional respect for life liberty and property of people, worldwide,
PLUS a libertarian culture. 

"The essential character of an unfree
society is the inverse, that which is not permitted is forbidden."

That's the inverse of the previous, virtually meaningless tautology. 

"The U.S. began as a free society without question;" 

That's a glaringly false statement. 

The US began as a **slave society** and remained a **slave society** until
a crazy **civil war** ended slavery well into the 19th century, though
that was **not** the main goal of the civil war anyway.

Today the US is the biggest fascist country on the planet (fascism =
militarism, nationalism, collusion of big business and government).

I'm wondering if Dan's technical views on so called cybersecurity are as
idiosyncratic as his political theory? 


 




From electromagnetize at gmail.com  Wed Dec 11 19:04:24 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Wed, 11 Dec 2013 21:04:24 -0600
Subject: catalog A & B (urls)
Message-ID: <CADhsnxdpfsbnfVM3YTsT_3JJ5=Qd1Fu0Htyft8VVuZno4BSBNQ@mail.gmail.com>

// contact electrification using patterned nanomaterials...
// note: the gap, equilbrium via chargeflow, as if via entropy.
// discovery originating from malfunctioning piezo-sensor...

Capturing wasted electricity with triboelectric generators
http://phys.org/news/2013-12-capturing-electricity-triboelectric.html

[quote] "Beyond generating power, the technology could also provide a
new type of self-powered sensor, allowing detection of vibrations,
motion, water leaks, explosions – or even rain falling." ...
"They have learned to increase the {power output density by a factor
of 100,000} by applying micron-scale patterns to the polymer sheets.
The patterning effectively increases the contact area and thereby
increases the effectiveness of the charge transfer." [unquote]

(the idea of energy harvesting includes recovering energy from
everyday kinetics, cars driving on roads, people walking on surfaces.
ubiquitous potential energy, how to gain access or tap into latent
energy sources everywhere.  this perhaps a viable approach to engage
the ubiquity if it is ever actually realized and retains its
economics; also- still not understanding how this is related or not to
electrostatics, is it comparable to an electrostatic generator or
electrostatic sensor that registers strain via charge movement,
perhaps at momentary high voltage like a static shock though cannot be
sustained thus about trickle charges, supercaps, those circuits,
perhaps zigbee-like self-sustaining sensor network infrastructures.
would it have potential for clothing to harvest small amounts of
kinetic movement and like charging a cellphone slowly, use longer
durations of time to harvest, attain, store usable current, in normal
applications)


Why Transit Riders Give Terrible Directions
http://motherboard.vice.com/blog/transit-riders-dont-know-where-shit-is

"Is cognitive passivity during travel wearing on city travelers'
abilities to create mental maps?"


// 16 segment LED display + persistence of vision,
// now imagine this as a ring platform for comms.
// else IR messaging to video via drone in night sky

AlphaPOV: An alphanumeric persistence of vision display
http://www.evilmadscientist.com/2007/alphapov-an-alphanumeric-persistence-of-vision-display/


[image] NSA as Ceiling Cat
http://i.imgur.com/HwJSaSY.jpg

[image] diagram
http://www.via.com.tw/en/images/initiatives/padlock/fig_aes.gif

What kind of sorcery illusion lets these two blocks be the same color?
http://sploid.gizmodo.com/what-kind-of-sorcery-illusion-lets-these-two-blocks-be-1478431828/@caseychan


== NSA question ==

how to validate this is the real cypherpunks mailing list
and not an emulation on an NSA server? is there any kind
of technical protocol that allows this to be evalauted. is
everyone seeing the same content. or if a mimic-site,
what if the substitute functions as the real list, etc.
in other words: could a person's entire online experience
be mediated through a false perspective WWW universe
constructed by forged sites maintained by the NSA...
and further, is it even possible to be outside control of
the NSA within an electromagnetic context, if targeted.
this involving not only telecom, also nervous system.
---


CF (collider function):  Harmony in Chaos
http://www.minted.com/design-rating/90358
http://www.mnartists.org/work.do?rid=342303


Geek Chic Computer Jewelry  // now what if it was functional...
High-tech Jewelry made from Computer & Electronic Components
http://www.pinterest.com/chipsetc/geek-chic-computer-jewelry/


== note on crypto ==

wondering if a distinction could be made in the realm of cryptology as
with other disciplines whereby there is an existing functionality and
then an edge condition of developing ideas where intuitions may be
pursued, tested, learned from.

i see people in various disciplines working on 'ideas' as part of
their work, whereas the same tasks can be pursued in purely
functional, managerial terms likewise, perhaps involving an existing
mode of operation versus evaluating various parameters or potential
paradigms.

in some sense then, as with art, there are artists who have skills and
can develop their work within a given set of parameters, and others
who may be more abstract and involved in this abstraction at the level
of ideas, questioning of existing presumptions. i relate this
condition and pursuit to 'conceptual art', rightly and-or wrongly,
having only an intuitive understanding of what it involves versus art
historical accounts of what it means and how it is identified.

then, so too with music. there are some who perform and develop music
within traditional or known parameters, and others who test or
question the limits though also in a deep realm of ideas. and this
tends towards 'conceptual music' in my sensibility, because more is
involved than what may be discerned from the aesthetics and it may
take more to understand it as it may operate in different parameters
than what is already known, and may need evaluation within a different
sensibility to access what it involves, which may center on grounding
of ideas or conceptions beyond a given interpretation, model, or limit
in standard approaches.

this then relating also to the rich realm of conceptual architecture,
typology seemingly having a unique role in this (ex. architects
Boullée and Ledoux from the enlightenment era when studying ruins and
the discipline of archaeology began, if remembering correctly, moving
into another realm perhaps tending towards the surreal compared to
existing approaches)...

Boullée
http://en.wikipedia.org/wiki/%C3%89tienne-Louis_Boull%C3%A9e
https://www.google.com/search?q=Boull%C3%A9e&client=firefox-a&hs=KOV&rls=org.mozilla:en-US:official&channel=rcs&source=lnms&tbm=isch

Ledoux
http://en.wikipedia.org/wiki/Claude_Nicolas_Ledoux
https://www.google.com/search?q=ledoux+architect&client=firefox-a&rls=org.mozilla:en-US:official&source=lnms&tbm=isch

(note: relation of Cenotaph for Newton and nuclear reactor, containing
fission of sun inside building type, significance for evaluating
landscape, environment, meaning, symbolism)

it is as if 'ideas' and their contemplation was more readily at the
center of questioning, the basis for what is developed, less so than
unquestioned conventions repeated as patterns. and this continued as a
major approach, including Le Corbusier and others, within certain
parameters, though a 'high conceptualization' can be involved in an
activity that in the griops of other practitioners is merely a
functional question that has already proscribed solutions that can be
uniquely or methodically rearranged though perhaps not fundamentally
questioned. so in some sense the fundamentals or basis or foundational
and its basics are secured and relied upon or brought into question
and further tested, experimented with, refined, or moved beyond
perhaps in particular circumstances as a model or approach.

this conceptualization continued into the 1960s (such as Archigram)
into the 1980s though its purpose seemed to be made profane, focused
on the image as a basis for abstraction, and the deeper questions of
architecture ignored for a shallow aesthetic approach that can be
hollow or ungrounded from 'reality' in some significant sense,
detached from issues and people and of a realm of CAD design, as if
architecture is only industrial design, creating pleasing objects or
sculpture devoid of economic, social, political, cultural issues it
involves, its deep meaning and insight, and instead, developing
blindness. this is more anti-architecture, the concept is not about
ideas but about extending an ideology of a particular warped value
system, and so the image is like an illusion of what actual
architecture is, in its greater purpose and mission. not trivial, not
just manufacturing buildings or 'culture' as if a fashion item to be
copied, reproduced as a trend or style, yet that is what it has
devolved to in tersm of its 'ideas', in many or most cases- if just on
its detachment from understanding nature itself and people and serving
these interests instead of designing building as part of a
political-economic flow that aestheticizes an existing and harmful way
of life, yet makes it as enticing as possible. (in this way the
excellent observation of such 'architecture' as pornographic forms, as
introduced by Dr. Elisabeth von Samsonow in The Plasticity of the Real
video lecture.)

i tend to consider this earlier intersection between archeology and
architecture vital for understanding both disciplines in their
interrelated depth, bridging past and future, and asking questions
again in a different context than just a present mode of operation.
thus to question and learn from ruins or evaluate a situation in a
larger context than it may otherwise have due to convention. and it
appears a lot is lost to narrowed conception of processes and existing
functioning that may limit potentials for insight and innovation
beyond the existing boundaries, again due to convention if not
conforming to rules or patterns or models that may already work in the
given constraints or parameters- though these too also change and
transform over time, yet the 'ideas' attached to them do not, and
often approaches can become fixed ideas or conceptions, as if the
world does not change becomes a routine is continued the same, even
while everything is shifting underneath yet may be unrecognized in a
given approach or even denied, to retain a way of doing things and
thinking, beliefs, etc.

so, a potential exists and perhaps it is like basic research of
architecture or a given discipline, where it may not be ready to be
applied or may question fundamental assumptions and this is purposeful
and can be extraordinarily beneficial if it cracks open the
malmodeling that may become standardized as approach, and allow other
development to occur by falsifying given notions or providing
alternative paths or techniques. and yet also, infrastructure can
exist that forbids this from occurring, that limits any such
conceptions, or confines questioning to what amounts to only small
tweaks in the functional circuitry because it is a situation that is
nearly completely controlled and there is little room within for
fundamental changes and an entire system would need to be rebuilt from
scratch to replace what exists, otherwise. and there are dreamers who
do this, and architects who focus on utopia. or modeling of cities.

Frank Lloyd Wright (FLlW) had his vision for the development of the US
which was based on a different approach to city planning,
democratizing it via planning principles if not mistaken, though part
of this was developing a low-cost affordable home (if not made of
concrete), the USonian home, a unit or component in the larger
integrated plan of massive development. Le Corbusier had skyscrapers
and green spaces as part of the Ville Radieuse (my memory is gone
though approximating a general sketch of approaches) and both these
efforts were based on social goals, what architecture and master
planning can effect via focused development. and Arcosanti by Paolo
Soleri is yet another example, building a prototype community with new
building techniques as part of a larger vision that is potentially
counterpoint to the existing approach, and that there is a tradition
of this questioning of existing development patterns and yet it is
also fraught with issues in the realm of ideas as relativism bounds
such inquiry.

http://en.wikipedia.org/wiki/Usonia
http://www.steinerag.com/flw/Artifact%20Pages/PhRtUsonAuto.htm
http://en.wikipedia.org/wiki/Ville_Radieuse
http://en.wikipedia.org/wiki/Arcosanti

for accuracy it should be noted that this innovation in thinking has
basically evaporated from the practice of architecture, it is
completely without support as a research endeavor in the given model
of education and development, as if the technical approach + aesthetic
fashion is the peak sum of its content as fixed-idea, though it is
more a purification of given ideology intimately tied to existing
warped economic, social, political agendas evidenced as "culture" that
is antihuman, against nature, against thought, essentially
anti-architecture as it exists.

so the conceptual potential of architecture, the critical questioning
of assumptions can be lost or drown out by other priorities or values,
superseded by a particular view or agenda that in turn limits what can
be pursued in that domain, as it becomes normalized, made a shared
worlview, institutionalized. yet likewise, detached from fundamentals
edited or censored out of existence given the tyranny of convention or
otherwise, e.g. deceptive motivations.

and so at the edge of development, there could be little blood
occurring because there is no real-stake involved at this leading or
front position. it could be somewhat mundane or basic or commonplace,
detached from significance or risk, and more about continuing to
extend a particular approach than testing, questioning, learning and
pivoting into other unknown or newly discovered realms via discovery,
innovation, invention, failure even and falsfication of beliefs and
approaches. defeat of ideology. instead- there are no ideas,
potentially. just the same old beliefs repeated ad naseum yet without
questioning them again and again, thus to assume their rightness or
correctness through their repetition, no more integrity than that.
thus mediocrity as a type of security even, doing what has been done
as a validation process or confirmation of value, matching a pattern
as pattern and not its truth it must represent. and thus the
detachment, the moving away from what is vital, developing in the
wrong ways and directions towards a false viewpoint and framework, if
not at odds with what is needed. and this all occurs automatically-
especially in peoples minds and thinking, psychologies and relations,
as individuals and groups then combine into organizations, continuing
such efforts.

conceptual architecture is then about ideas. thinking through
architecture, architecture as a model, a medium for ideas. for
communication and relation. the importance of language in all the
above examples, and its fundamental relation to geometry (art, music,
architecture). and this fundamental consideration also involving a
kind of philosophical approach to the questioning, in terms of
research, the basics, fundamentals, foundation of disciplines and
beliefs, techniques approaches actions, methodology. questioning,
debate, discussion, the role of basic research in development, its
application over time via refinement, testing of hypotheses and
improvement of models and approaches. it is not just engineering
alone.

and it also involves a larger domain than just a detail, so while
research into concrete may always be ongoing, that concrete sidewalk
technology around for thousands of years since Roman times, the heated
sidewalk or improved wear or illumination or concrete via other
additives to the mixture is not in itself a larger modeling of the
depth and breadth of the question of architecture beyond that narrowed
realm- though can be incorporated into it as a vital detail, and so
definitely is related, though a part of a larger research enterprise,
a larger more encompassing and ecosystem view, where each detail has
its value and importance and insight, yet in the realm of ideas, 'big
ideas' need to occur to frame the big situations, and to limit these
to finite or specific details then bounds what can occur.  it is
equivalent to saying we can build skyscrapers to look like furniture
and if that is all it involves, a vast many other potential realms of
questioning or consideration can be lost in the process as it is
defined and conceived, in terms of what is and is not considered, put
on the table in terms of questioning. for most the skyscraper itself
as a building type has become a default solution, so too the high rise
city as a defacto approach to eco/soc/pol development, yet it is
fraught with vast many problems and creates and solidifies certain
patterns that are ineffective, inefficient, though believed the
correct way because that is the standard, the way things are done
today and how wealth or success has been generated. it is an engine,
in other words, that provides momentum to many industries and
questioning it as foundation could even be heretical. and thus if
questioning is removed, everything works just like a machine. yet a
machinery that is functioning against life, the earth, people,
economics, society, and other dimensions if a true accounting were to
take place beyond the controlled viewpoint that secures this approach.

conceptual architecture potentially could delve into these areas, yet
without support or even vital influence upon these processes, either
for being unrealistic or uneconomical or without existing capacity,
technology, or other limitations that restrict alternatives from
developing. again- the lack of research and its replacement by a
default 'ideology' the indicator that the process is determined by an
existing agenda that does not want to be fundamentally questioned in
its rightness, correctness as method, practice, income-generating
structuring.

and yet an amazing discipline such as architecture can then lose its
soul, its essence, its insight and become shallow, ungrounded from
reality, and force disconnection through its development which then is
no longer actual or real architecture and instead something else, a
substitute process that stands-in for it as mimic, yet operating
within different principles that confine questioning to a narrow range
of consideration that basically destroys it, the ideas turning to
answered questions, architecture turned against itself, becoming only
a question of engineering, the art of construction being about
decorative buildings instead. though no deep insight into the human
condition beyond an archaeological condition where these forms can be
evaluated, analyzed, as they map to social, political, economic
issues, versus serving people as part of a heightened moral and
ethical obligation, service to culture and its development, not
turning away from it for money or just another career, etc. and thus
'the ideas' of architecture are nowhere to be found within the field
as it exists today, they are instead censored out of it by default of
the existing securing of ideology within institutions as this then is
the basis for further development within constrained parameters of
"design" that has more in common with the particularities of fashion
than wide-ranging investigation into questions and understanding and
development of culture in its highest manifestation, to include the
role of technology and its coherent and innovative integration within
built form, which instead becomes a manufacturers and industry
consideration: "smart homes", etc. this versus master planning of
civilization across all of its dimensions in a cohesive clear vision.

this as context for cryptography, in that there may be a standard
approach via public-key or other security systems in place that have
become normalized, made routine as processes and that assumptions may
readily exist as 'solutions' that remain bounded in given
considerations while there could be more going on beyond the existing
framework or limits of these same systems in practice, when evaluated
in terms of basic research, tweaked or tested or broken, and this
appears part of a vital process of improving and securing
cryptographic systems even. that a basic RD&D process exists already,
though to still question- within what parameters and is it possible
that the existing modeling is based on fundamental assumptions that
could in some way be limited or narrowed and a larger inquiry is
restricted because of these beliefs that become 'assumed truths' via
their restricted boundaries,  as if knowns or certainties due to
history or precedent yet these not brought back into questioning again
(reinterpreting of previous models, as if archeological ruins even,
where new insights may still be available or other approaches
discovered through their reevaluation and testing of assumptions).

it is to question if there may be a distinction made between
cryptography that is operational and active, that exists as an
infrastructure and working system (however rube-goldberg the issues of
implementation, chaos of variability as it connects with
secured/insecure modes), and what may be a more research-oriented
approach, not just into mathematical approaches to cryptographic
modules, and instead potentially further into the most basic realm of
crypto questioning, perhaps at the level of signs & symbols (language)
and how operations function (geometry) instead of an algorithm that is
operational as software approach or methodology, within a given or
existing set of parameters or assumptions that may be relied upon yet
also may be limited or even false in certain instances or deny other
approaches from occurring.

in other words, it is to wonder if there is a realm of 'conceptual
cryptology' that may already exist and yet not be defined or
understood this way, or 'conceptual cryptography' in a more particular
realm whereby these core questions of cryptographic models could be
pursued in their depth- or does the existing institutionalization of
these "ideas" restrict these inquiries due to a forced perspective of
ideology, a particular value system that relates to economic, social,
political pressures that retain a given approach for the good of
institutional control or manufacturing or to keep validating the
static conception, even as it may deteriorate within its 'ideas' made
static, assumed true by their repetition and continual access,
matching the sign equals sign as confirmation of correctness, versus
grounding in this greater depth of inquiry and realm of potential and
perpetual insight, when going back to the source and evaluating the
situation with fresh eyes and minds, in the dimensions that exist,
which could be far more than is modeled or believed or allowed in
existing approaches or functioning.

as with archaeology and architecture, it is to question if
cryptography may have a unique in situ condition at this intersection
of language and geometry, that currently may exist outside its
conceptualization in terms of practice, as crypto is developed
systematically, as it is made into infrastructure via technology,
manufacturing, and extension of these. and here, of the danger of
ideology, answered questions that move towards further falsity, as if
unconscious, when questioning of 'ideas' becomes detached from action
and through further development becomes ever more disconnected from a
fundamental condition of truth than in service to it. and what if this
integrity, securing this foundation of cryptography in truth is
requirement for security, yet given existing parameters could be
ignored in its philosophical dimensions that predate, inform, and give
life to the discipline, yet may not be valued or identified or related
to this way, as it becomes institutionalized or supported, made into
systematic development.

is there such an entity as 'conceptual cryptography' and where does it
begin and end. how might it be different than a primarily engineering
based approach or evalaution or crypto. to what extent is it supported
and operational as inquiry, yet what parameters or domain does it
occupy, including in past times and efforts that map out this
relation, its core questioning. could it today function in non-crypto
domains yet influence crypto development, etc. and thus questions of
the universality and connectedness of patterns, their permutations and
relations, potential interdisciplinary relevance as language and
geometry across mediums.

(if not involving inquiries and in-depth research at the junction and
structural intersection of linguistics and mathematics, and a
wider-range of potential communication strategies.)
---


[image] album cover
http://rbhsjukebox.files.wordpress.com/2011/09/mannlost.jpg

[image] Nelson Mandela & EM aesthetics
http://24.media.tumblr.com/45424eb2509739cc87f0120b8e91af89/tumblr_mxctqtfiNJ1qjo9duo1_500.jpg


== re: Amazon LCD tablet ==

i grew up studying those giant shopping catalogs for Sears and JC
Penneys stores that had inventories of everything in stores and that
could be mail ordered. they were seemingly hundreds of pages thick,
consumer bibles of specific national retailer chains in the U.S. and
for those without encyclopedia, did offer an interesting look into the
development of digital watches as they took over analog, calculators,
early computing, electronic and video games, and then 'electrics'
spanning tools to housewares, various large and small appliances.

when the Amazon Kindle lineup went from e-ink only into a
mixed-category of LCD screens it seems to blur the distinction in
purpose between the e-reader devices and more ordinary tablets that
compete with others, in particular ecosystem-based devices from Apple.

my initial thought was that there were two different categories
occupying a single name of "Kindle" and that they were functionally
very different devices with different purposes.

while it is understood that 'tablets' are a category unto themselves
and need no further justification for existence in an online retail or
software/app model, it struck me as strange that there was not
something more conceptual going on with the Amazon HD Fire devices,
beyond ordinary tablet functionality, at least from what reviews
mention about it in terms of user experience and how it streamlines
access to Amazon services through the tablet UI.

one thought has stuck with me about the potential for this
tablet-Amazon ecosystem relation and it is that this device now
competes with others in a general 'multimedia' tablet category, yet
its real and potential advantage in terms of apps or whatever is its
unique connection to Amazon inventory, which spans multimedia in an
intranet sort of way, perhaps as if portal.

from here, at this location, in this particular and unique context of
relation between those who access Amazon through such a tablet
interface, it would appear the killer functionality of such an LCD
tablet would be to provide 'catalog-like functionality' in the style
of earlier paper-based approaches, such as the Sears Catalog and
others, though perhaps beyond just existing approaches determined by
web interfaces and into a higher degree of functionality, such that
the tablet actually is the Amazon Catalog in electronic format, in
particular- mail-order format whereby, say, ala Whole Earth Catalog or
Hammacher Schlemmer, you could potentially order anything that Amazon
lines up into its supply-chain, even if for a one-time sale, via such
a massively connected inventory and integrated yet distributed
delivery system.

This probably sounds very bad to some peoples ears in terms of the
impact or effects this could have if suddenly Amazon is bidding on
installing pools in the neighborhood, though perhaps it would be
bounded to certain things like European appliances that are imported
or other high-rated, quality based interactions vetted by a
review-system recovered from the troubles of existing feedback
environments internet-wide.

curated merchandize, then, that is presented in deep categories of
content, with additional information (requiring dimensions of items
from manufacturers, etc) and matrix-based searching functions (using
grids and geometry to search instead of only keywords) that then are
the basis for a _new_design of the Amazon interface that standardizes
the interface and user experience with the available inventory,
instead of relying on existing web technologies to define parameters
for what can occur in these interactions, including variable results.

What this is to question is why the Amazon Fire LCD tablet is
competing in a multimedia category as if just another tablet when
instead it could be 'the Amazon Catalog' instead and while able to
deliver movies, music, book content, that ultimately a programmatic
hierarchy could exist that this is a platform for interfacing with and
accessing Amazon inventory firstly, before that secondary utility,
which allows delivery of online data (movies, movies) though also, and
primarily it is assumed: offline 'content' in terms of sales from its
warehouses and third party suppliers, and thus is the basis for
creating, sustaining, and developing this huge momentum in sales, or
having it operate in more conventional terms, competing as another
tablet in a highly competitive space, and perhaps not having this
catalog-functionality as its core mission to the extent that this is
how the tablet is designed, its fundamental purpose and advanced
functionality, versus just an extension of existing web technology
approaches that leverage an excellent e-commerce experience though
remain heavily defined by what is a very low-resolution 'catalog' of
its inventory, when instead there could be more extensive information
about each item, so that people do not need to research missing facts
or data repeatedly and instead it could be presented as advanced specs
(dimensions, materials, warnings; contains lead, requires widget Z),
that combined with expert reviews or more in-depth analysis could
transform the experience into a research-based activity where all of
the necessary data is in the Amazon Catalog, perhaps not the web
version, but the tablet catalog version that acts like an encyclopedia
attached to extended or other content or dimensions.

For instance, if a product attaches to a table, yet no information is
provided for how this connection takes place or how deep or thick the
table must be, the same item could be ordered and then returned if it
does not fit a particular table. And if this information is not
provided for in the reviews, then orders and returns are the 'feedback
process' that is in effect a negative interaction as a total exchange,
inefficient, and time-wasting for everyone when instead that
additional information which could be known to be critical (no less by
the product manufacturer) could be provided as _missing detail in the
current approach, in many cases, with sales across the online retailer
landscape. It could require several google searches of discussion
forums or downloading PDF manuals to get this information if it exists
or a call to the manufacturer, all that stands in the way between
simply evaluating the item and then deciding it will work and clicking
through the sale. Instead this short-circuit of necessary or missing
information could require dozens of clicks and several searches of
discussion groups looking for answers or clues to what may become a
mystery by default.

Consider then the condition whereby there is lack of basic information
in this entire process, encountered with online retailers and
e-commerce in general, not just Amazon of course. It is assumed when
product data went online, that perhaps nothing new was expected of the
items in the way they were modeled as 'data' in terms of their sale.
Yet for instance this same product was in a store in yesteryear, it
could be touched, evaluated as a 3-dimensional item, and if it
attached to a table the mechanism to do this could be evaluated or a
box could be opened by a worker to help evaluate the device to see if
it actually would fit a particular table or not - prior to sale. And
here is point: the information is available for the person in the
store, though when it is sold online this information may be
non-existent online even though it is a very basic consideration for
its practical and successful use in basic scenarios and everyday
conditions. It is unexceptional to ask such questions in an offline
context, yet when this same questioning occurs in a remote
'catalog-context' or 'online retailer' context often there is no one
to ask or anyone who knows the answer, and it instead is a gamble.

The way this is made to work is by offering free returns, and yet this
also effects other prices and is a structural inefficiency if it could
be solved and such returns unnecessary when they could instead be
avoided, due to an issue such as 'missing information' that is
important to the seller and the buyer, to know enough about the item
at the center of such exchange.

Thus, of various products sold online, consider if they had a more
robust and in-depth data model that consisted of various "dimensions",
and therefore if there were these attachment devices to tables, you
could narrow a search for such items not just by the main category
{tablet attachment}, and instead further by subset details, such as
{clamp to 2-3/4 inches} when others only may only open to 1-1/4 inch
and therefore would not fulfill the criteria.

And so in modeling a particular item or device, as category, it could
be modeled in various subset details that may already occur in areas
like HDTV sets, to some limited extent (a bit too fuzzy whereby false
positives are frequent as with many hierarchical approaches based on,
it is assumed words versus geometric structures based on such
functional details). In some sense it could be equivalent to a limited
'dimensional-search' via matrix, that in some cases may involve
measurement (height-width-depth), color, form or shape, materials, and
other specifics (calories, toxins, requirements). Then instead of
searching from the general to the specific, looking for the needle, a
person could start with the needle, knowing what they usually are
looking for -though cannot find- and located it through geometry of
such data.

In this way, potentially the future of online catalogs in a tablet
interface as it may streamline the process of interaction and exchange
with this data ecosystem of media and other goods.

(concepts: patterns, typologies, variable details, relational structures)

(also, this strategy could be used for other search via structurally
organized -if meta- data as a content or information search via
categories, dimensions, graphs and grid. dimensions, 3- and N-value
logic, set theory, AI interface and interactions. tending toward
'living queries' where, given parameters, search could continue or
map/carto/survey realms, provide reconaissance, report back data
structures, variables. this could be basis for custom data structure
of PC, a model built up over many queries, spanning local-global
structure, heuristic feedback, etc.)
---


Scientists jump the "air gap" with hidden acoustic networks
http://www.gizmag.com/malware-jump-air-gap/30056/



== urls via hh ==

(of lithophones and ringing stones... Stonehenge as xylophone)

Researchers reveal Stonehenge stones hold incredible musical properties
http://www.ancient-origins.net/news-history-archaeology/researchers-reveal-stonehenge-stones-hold-incredible-musical-properties#sthash.5sFOm8XZ.dpuf

-- in article url, refrenced with audio sample & video...

Stonehenge 'was a prehistoric centre for rock music':
Stones sound like bells, drums, and gongs when played
http://www.dailymail.co.uk/sciencetech/article-2515159/Why-Stonehenge-prehistoric-centre-rock-music-Stones-sound-like-bells-drums-gongs-played.html#ixzz2nDQtpHeZ


 // electromechanical codebreaking machine 1938

A Codebreaker's Dream: The Bombe!  (photo-essay)
http://www.darkroastedblend.com/2013/11/a-codebreakers-dream-bombe.html#sAhsgSbJIqD8aUCu.99


// archeology and the unlocking of remote time & communications...
// to decipher rightly and wrongly, conundrums of political cryptology

[review]  The Riddle of the Labyrinth: The Quest to Crack an Ancient Code
http://www.nybooks.com/articles/archives/2013/dec/05/what-was-greek-to-them/

"But then what? The sequel to the decipherment is little more than a
final, self-evident coda to most of these stories. “Enigma” is broken,
so the Allies win the war; hieroglyphs are decoded, so the culture of
pharaonic Egypt is revealed to us. What this conceals, however, are
all the further disputes and rivalries that regularly follow the
successful cracking of the language or of the code. Just how correct
was it? And, if it was, what does it tell us about the culture
concerned, or the history of the period? Whose theories are now
confirmed or disproved? These controversies can be just as exciting
and bitter as those leading up to the decipherment, and probably more
significant. But we rarely get to hear about them before the heroic
tale ends."

(note: on archaeology, often referred to as excavations of the past,
centuries ago though this moves into decades ago, particularly with
industrial archeology, or potentially even the near-present especially
in terms of media, as this relates to crypto, hacking, cracking,
exploits, etc. that is, discovering not stone tablets and instead
electronic tablets with known or unknown security measures. as related
to ingenious techniques for how to access the locked-in data without
having it vanish, such as freezing chips or other surgical critical
access methods;

note: should also mention data archeology and data recovery belonging
to this same context. in archaeology often trash sites are highly
valued for the information they bring, proverbial 'trash to treasure'
scenario. thus to consider old data, databases, or even receipts in
this way, as with inventories in Linear B. and what actionable realms
does that relate to within today's processes: corporate intelligence
or whatever, to model a situation, exploit information, etc.
('exchange your electronics' for rebates or upgrades, and the hidden
data could be gleaned and monetized, though perhaps someday another
route to recovering rare elements instead of mining them, gold,
silver, rare earth metals from old circuit boards. preexisting
approaches within new EM context: archeology, geology/mining,
crypto/spying, on and on, into today)

the relevance of archeology does not stop here either. concepts and
methods could be useful in computing, developing a new data structure
to access information via layers or time-based evaluations,
reconstructions, modeling, etc. then also the great tools, LADAR and
others. just the issue of dust alone, reimagined in future of smart
dust, traces of info everywhere, data fossilization, TSCM-like
correlations. thus interdisciplinary structures, models and methods,
knowledge, shared value. integrating perspective via n-dimensionality,
unified frameworks, continuum of truth throughout shared cultural
scaffolding via logical reasoning, maximized, optimized, tested and
improved. thus what might archeology have to offer crypto/security and
development of computing in the realm of paradigm, conceptualization,
understanding, meaning, integrated modeling, measurement, organization
of data, archive and records, inventory, digs, reconstructions,
research, mapping & cartography, language, excavation)

{educational fair-use of copyright, 2013}

452a, 392h, 902c




From adi at hexapodia.org  Wed Dec 11 21:15:38 2013
From: adi at hexapodia.org (Andy Isaacson)
Date: Wed, 11 Dec 2013 21:15:38 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
Message-ID: <20131212051537.GA20782@hexapodia.org>

On Wed, Dec 11, 2013 at 06:28:31PM -0800, Steve Weis wrote:
> On Wed, Dec 11, 2013 at 6:00 PM, coderman <coderman at gmail.com> wrote:
> > unredacted:
> >  https://peertech.org/dist/nsa-cpp-goals-FY2013-unredact.png
> >
> > "Intel Ivy Bridge"
> 
> Is this a guess because "Intel Ivy Bridge" fits into the redacted space or
> is there some other evidence?

I believe it's just a guess based on fit.

> Ivy Bridge processors are general purpose x86 CPUs. It doesn't make sense
> to me to refer to it as an "encryption chip" for "web encryption devices".
> Do you know of products using IVB processors for SSL offloading or in VPN
> appliances?

Suppose I'm the manager writing this document, reporting the expected
accomplishments of my group.  We do cryptanalysis.

If we're projecting success against FooBarCo chips' encryption sub-core,
and everybody knows FooBarCo chips are used in both encryption and
non-encryption products, it makes sense to cite the specific
applications where FooBarCo chips are used.  So "for FooBarCo chips used
in VPN and SSL" makes sense, even if FooBarCo chips are not *solely* VPN
and SSL.

However, in "for FooBarCo encryption chips used in VPN", the
"encryption" seems to me to denote a special purpose chip, rather than a
general purpose chip with an encryption sub-core.  I've seen worse
manglings of language in similar documents, though, so I would not put
it past said middle manager to write "for Intel Ivy Bridge encryption
chips used in VPN and SSL", even though that's a bit of word salad to
anyone who knows the technology.

> To me, the redacted document sounds like it's referring to a security
> processor used for SSL offloading. For example, something like a Cavium
> Nitrox (which I'm not implying is the subject of the document).

"Cavium Networks" or "Cavium Nitrox" are approximately the right length
to fit.  Other vendors that might be interesting include F5, Barracuda,
Riverbed, Cisco SCA 11000, Radware (an Israeli/American company), and
everybody listed on http://en.wikipedia.org/wiki/SSL_Acceleration

The document looks like Word and appears to be fully justified; anyone
with that software want to match the fonts and try out various
substitutions to see what fits best?

Note that
http://s3.documentcloud.org/documents/784159/sigintenabling-clean-1.pdf
seems to have been digitally processed and redacted; the font baselines
are perfectly aligned, to the sub-pixel antialiasing limit; while
http://s3.documentcloud.org/documents/784280/sigint-enabling-project.pdf
appears to have gone out to paper and then been scanned in on a
non-flatbed scanner; there is significant vertical slew across the line
of text in question.  Since the source document appears to be the same
for both, an enterprising DTP jockey could use -clean-1.pdf to tune the
document settings precisely, and then use -project.pdf to search for
better unredaction matches.

-andy




From coderman at gmail.com  Wed Dec 11 23:41:41 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 23:41:41 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <20131212051537.GA20782@hexapodia.org>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
Message-ID: <CAJVRA1QJ6eczCf4ruD9q2JYE2wCsM-5zJoH7Jptv0WxoSv-95w@mail.gmail.com>

On Wed, Dec 11, 2013 at 9:15 PM, Andy Isaacson <adi at hexapodia.org> wrote:
> ...  Since the source document appears to be the same
> for both, an enterprising DTP jockey could use -clean-1.pdf to tune the
> document settings precisely, and then use -project.pdf to search for
> better unredaction matches.


i remember seeing software to do this, but for the life of me cannot
find it.  anyone?


my favorite redaction technique is still the Adobe white text on white
background in PDF trick; combine with a filter for CONFIDENTIAL /
PROPRIETARY and you've got a fire hose of informative flotsam...[0]

best regards,


0. "The Revenge of Distance: Vulnerability Analysis of Critical
Information Infrastructure"
  http://arxiv.org/abs/cond-mat/0310427
back when Sean Goreman's work and post 9/11 hysteria combined to drive
critical infrastructure information into access controlled obscurity
(not even FCC outage reports public!) i used this technique with
custom deep web crawlers for court documents and other technical
references.  code doesn't care about color ;)   thus fiber counts
along specific rights of way allocated to named customers provided the
specific capacity information needed to make useful models for
measuring "spatial implications of telecommunications infrastructure
susceptibility to targeted attack".  this was the first time i wrote
code that actually scared/disturbed me :o




From coderman at gmail.com  Wed Dec 11 23:46:24 2013
From: coderman at gmail.com (coderman)
Date: Wed, 11 Dec 2013 23:46:24 -0800
Subject: [tor-talk] Tor 0.2.4.19 is released
In-Reply-To: <20131212054747.GH6713@moria.seul.org>
References: <20131212054747.GH6713@moria.seul.org>
Message-ID: <CAJVRA1Qcqj_y-v=Zaj1EB_1DpWxg=HRg_YdD-5dheZBKu3e_6w@mail.gmail.com>

On Wed, Dec 11, 2013 at 9:47 PM, Roger Dingledine <arma at mit.edu> wrote:
> The Tor 0.2.4 release series is dedicated to the memory of Aaron Swartz
> (1986-2013). Aaron worked on diverse projects including helping to guide
> Creative Commons, playing a key role in stopping SOPA/PIPA, bringing
> transparency to the U.S. government's PACER documents, and contributing
> design and development for Tor and Tor2Web. Aaron was one of the latest
> martyrs in our collective fight for civil liberties and human rights,
> and his death is all the more painful because he was one of us.


thank you for this!


aaronsw++




From dan at geer.org  Wed Dec 11 21:48:16 2013
From: dan at geer.org (dan at geer.org)
Date: Thu, 12 Dec 2013 00:48:16 -0500
Subject: Tradeoffs in Cyber Security
In-Reply-To: Your message of "Wed, 11 Dec 2013 20:42:53 -0300."
 <36EBF5782B0B75E037276B96@F74D39FA044AA309EAEA14B9>
Message-ID: <20131212054816.6E8522280C5@palinka.tinho.net>


 > I'm wondering if Dan's technical views on so called cybersecurity are
 > as idiosyncratic as his political theory? 

Yes.

--dan






From coderman at gmail.com  Thu Dec 12 06:08:35 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 06:08:35 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <20131212051537.GA20782@hexapodia.org>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
Message-ID: <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>

i see your skepticism, and i raise you a retort! ;)

i even have a list of candidates you can experiment with to confirm
Intel Ivy Bridge as best fit. [0]



On Wed, Dec 11, 2013 at 9:15 PM, Andy Isaacson <adi at hexapodia.org> wrote:
> ...
> Suppose I'm the manager writing this document, reporting the expected
> accomplishments of my group.  We do cryptanalysis.

plus a few more things, e.g. your ~250-300million $USD/year budget goes toward:
"actively engag[ing] the US and foreign IT industries to covertly
influence and/or overtly leverage their commercial products' designs
[... to] make the systems in question exploitable through SIGINT
collection (e.g., Endpoint, MidPoint, etc.) with foreknowledge of the
modification. and, Insert vulnerabilities into commercial encryption
systems, IT systems, networks and endpoint communications devices used
by targets.

only with "foreknowledge of the modification" are you able to utilize
this backdoor. (NSA does not like to share)


also, this year by end of year, in 2013 you expect to:
- Make gains in enabling decryption and Computer Network Exploitation
(CNE) access to fourth generation/Long Term Evolution (4GL/LTE)
networks by inserting vulnerabilities.
- Complete enabling for [well recognized name] encryption chips used
in Virtual Private Network and Web encryption devices.
and last but not least,
- Shape the worldwide commercial cryptography marketplace to make it
more tractable to advanced cryptanalytic capabilities being developed
by NSA/CSS.

Ok, given those requirements. Who fits the bill?


High end platform:
http://www.techweekeurope.co.uk/news/intel-networks-high-end-platform-133501
"""
Intel targets what it believes is a significant growth opportunity to
bring the Intel Architecture into a rapidly evolving networking space.
...
Intel added to its portfolio with the introduction of the Highland
Forest platform, which combines the vendor’s Xeon E5-2600 v2 CPU with
its new Coleto Creek chipset. Price said Highland Forest – which can
pack up to 20 2.4GHz “Ivy Bridge” CPU cores – will offer two to six
times the performance of the previous Crystal Forest platform, which
was launched in October 2012.

Highland Forest, with Intel’s Data Plane Development Kit, can deliver
up to 255 million packets per second (p/s) – more than the 140 million
p/s from Crystal Forest – as well as security capabilities of 110
Gigabits per second of IPsec and 200 Gb/s SSL security for encrypted
traffic.
"""


IPsec (VPN) and SSL (Web crypto) and lots of it!  sounds interesting.
tell me more!


other market points of note:
- "Intel currently has over 15 SDN/NFV qualification trials underway
with carriers in all major regions.  Schooler emphasized that Intel
has no intention to sell directly to service providers and is fully
committed to launching an Intel Network Builders Ecosystem of industry
players supporting the Intel Architecture."

- "6WIND Announces Availability of Support for Intel® Xeon® Processor
Platform for Large-Scale Communications Infrastructure Systems,
Formerly Called “Highland Forest” 6WIND announces the availability of
support within the 6WINDGate™ software for the Intel® Xeon® Processor
Platform for Large-Scale Communications Infrastructure Systems,
formerly called “Highland Forest.” With its optimized support for the
Intel® QuickAssist Technology that provides hardware acceleration for
encryption and compression, 6WINDGate delivers best-in-class
performance for networking applications such as WAN optimization, VPN
appliances, firewalls and Unified Threat Management (UTM) systems." -
funny they seem to distance themselves from "Highland Forest" and "Ivy
Bridge" in this press release and product launch...  [
http://www.prweb.com/releases/2013/12/prweb11387583.htm ]

they sound interesting, like they sell to many industries at large
scale.  are they a popular company/product?

 ""“6WINDGate is already deployed in tens of commercial LTE networks
throughout Asia, Europe and North America, while also being used by
multiple tier-1 suppliers of enterprise and cloud networking
equipment.""


hey look, LTE! ...


ok, so that's a little suspect.  what's that, there's more you say?

https://plus.google.com/+TheodoreTso/posts/SDcoemc9V3J
"I am so glad I resisted pressure from Intel engineers to let
/dev/random rely only on the RDRAND instruction."
, "Oh, I should add that just today I had to fight back an attempt by
a Red Hat engineer to add a configuration option to blindly trust
RDRAND and bypass the entropy pool"

...

then the FreeBSD change of heart.

hey Wind River, how are you using RDRAND?



now what about Intel themselves, are they also pushing the chip?
"""
Intel officials are making aggressive moves to expand the reach of its
silicon beyond servers and into other parts of the data centre.
Schooler said the company has been making products for networking gear
for about a decade, and has made significant strides in recent years.

It’s also made several acquisitions – such as of Sensory Networks,
Ethernet chip maker Fulcrum Microsystems and networking software maker
Aepona, whose technology enables telecoms and cloud service providers
to offer more services on their networks.

Intel is looking to take advantage of the growth opportunity
networking represents, Schooler said. The market Intel is targeting is
about $16 billion (£9.7bn), and the chip maker currently has about 5
percent of it. Along with its x86 architecture, Intel also is
developing accelerator chips for such jobs as packet inspection and
encryption.
"""




whew.  that's a lot of context and circumstance.  let's look back over
your goals for 2013:

Make gains in enabling decryption and Computer Network Exploitation
(CNE) access to fourth generation/Long Term Evolution (4GL/LTE)
networks...
 - AFFIRMATIVE!

Complete enabling for [Intel Ivy Bridge] encryption chips used in
Virtual Private Network and Web encryption devices.
- AFFIRMATIVE!

Shape the worldwide commercial cryptography marketplace to make it
more tractable to advanced cryptanalytic capabilities being developed
by NSA/CSS.
- AFFIRMATIVE!


i will admit that i am continually impressed by NSA/SCS achievements.
they're extremely competent!



> If we're projecting success against FooBarCo chips' encryption sub-core,
> and everybody knows FooBarCo chips are used in both encryption and
> non-encryption products, it makes sense to cite the specific
> applications where FooBarCo chips are used.

agreed.



> However, in "for FooBarCo encryption chips used in VPN", the
> "encryption" seems to me to denote a special purpose chip, rather than a
> general purpose chip with an encryption sub-core.

my reading between the lines: it is not a special chip, it is a
special collection of many of them (20+) handling tier-1 core traffic
encryption, which is an excellent point to aggregate a vulnerability
in keying ciphers. (ignore public key for now, since we can just focus
directly on session/temporal keys!)




> "Cavium Networks" or "Cavium Nitrox" are approximately the right length
> to fit.  Other vendors that might be interesting include F5, Barracuda,
> Riverbed, Cisco SCA 11000, Radware (an Israeli/American company), and
> everybody listed on http://en.wikipedia.org/wiki/SSL_Acceleration


0.  please to be experimenting with datas:
Interface Masters Technologies
Freescale Semiconductor
Alteon SSL Accelerator
Nortel SSL Accelerator
Strangeloop Networks
Riverbed Technology
Coyote point systems
Crescendo Networks
Microchip PIC32MZ
Barracuda Networks
Kemp Technologies
STMicroelectronics
Check Point VPN-1
Sun Microsystems
Foundry Networks
Cavium Networks
Cavium NITROX
Juniper Networks
Nortel Networks
Array Networks
Intel Ivy Bridge <- only this is right length in justified context shown
Forum Systems
Cavium Nitrox
CAI Networks
A10 Networks
Cisco Systems
Citrix Systems
Sun SCA6000
MIFARE Plus
Network Box
Coleto Creek
F5 Networks
jetNEXUS
Cisco PIX
Radware
Cotendo
Exinda
Hifn
IBM


---


parting words:

"""
On April 17 at the Open Networking Summit, Intel executives laid out
the company’s strategy around data center networking and the
burgeoning trend of software-defined networking (SDN). They also
showed that their efforts will expand beyond simply supplying the
processors for networking hardware. The company unveiled reference
architectures designed to help enterprises, cloud service providers
and telecommunications companies more quickly create hardware and
software for SDN and network-function virtualization (NFV), moves that
could bring Intel into closer competition with the likes of networking
giant Cisco Systems and chip maker Broadcom.
 - http://www.eweek.com/networking/intel-makes-push-into-competitive-sdn-space/
"""


don't let them get away with it!

open up raw access to entropy sources!!

don't discriminate against the unit, one is prime!!!




From coderman at gmail.com  Thu Dec 12 06:52:20 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 06:52:20 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
Message-ID: <CAJVRA1Qnt28bbcqOcgL-5Ky6EGOEWTUWEBO0cuZGe69=2fUiNw@mail.gmail.com>

one last amusing note, Google has gone whole hog on SDN:
  http://www.networkcomputing.com/data-networking-management/inside-googles-software-defined-network/240154879


how amusing would it be if they implemented inter-DC IPsec keyed with
RDRAND directly on compromised cores in one of these Highland Forest
like SDN deployments?

i can already see the updated napkin sketch now, and imagine the
streaming swears pouring forth from the googlies once uncovered...




From coderman at gmail.com  Thu Dec 12 08:20:44 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 08:20:44 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <E1Vr7s1-0004qb-PM@elasmtp-kukur.atl.sa.earthlink.net>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <E1Vr7s1-0004qb-PM@elasmtp-kukur.atl.sa.earthlink.net>
Message-ID: <CAJVRA1Qv-bKo+LBiES5DCxBmQz_jmDdsq4RqoVLSUr50==nqHg@mail.gmail.com>

On Thu, Dec 12, 2013 at 7:08 AM, John Young <jya at pipeline.com> wrote:
> Please stop this suicidal, treacherous discussion. You're undermining
> the global industry of weak crypto and comsec. That counts as economic
> terrorism in all the countries who abide arms control, export control,
> copyright, capitalism, heirarchical rule, suppression of dissent, lawful
> spying, breaking and entering black jobs, ubiquitous spying on each other
> and everybody else, ...
> ... Sure, call for outraged dissent,
> fine, great, if that moves the ponzi, balloons those bitcoins.


let it be known:

in the event of my untimely demise under suspicious circumstances, i
will my coins to JYA so he may bless my passing with grand oration and
strong tale as he is so adept at providing.  *grin*


on a serious note, the useful steps are clear:
1. Intel releases raw access to noise samples
2. NIST defining and mandating a design that also supports raw sample
access, (we could change subject here to discuss something pleasant
like on-line checks and continuous checks,)
3. OS distributions include userspace entropy scavenging daemons
(haveged, dakarand, etc) to complement properly vetted hardware
entropy sources run in a conservative fashion.  default is set safe,
not fast.

is that so much to ask?




From coderman at gmail.com  Thu Dec 12 08:42:02 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 08:42:02 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
Message-ID: <CAJVRA1QWQAq1qtcihWkyH8B=OpafJYXJ2nb1ys+zyKWvG21jQg@mail.gmail.com>

On Thu, Dec 12, 2013 at 8:04 AM, Steve Weis <steveweis at gmail.com> wrote:
> ...
> The document is talking about FY2013.  IVB already shipped in 2012. I'd
> guess it was fabricated for testing in 2009-2010 and designed for a few
> years prior.
>
> What enablement would be "complete" in 2013 for something that has been on
> the market a year and is already being phased out?

the bulk of 2012 was consume user hardware.  the endpoint is a totally
solved problem (read: trivial to exploit in many ways, all day, every
day, per the docs)

only server Ivy Bridge: Xeon E3 in mid-2012.

the cores pushed in the SDN initiatives above came out not so many months ago...

high capacity crypto aggregation points like this are an ideal target,
with backdoor keying of VPN/SSL the ideal (passive) attack with their
view of target's long haul fiber.



> By 2013, Intel had already started shipping Haswell. They did launch new IVB
> E5v2 Xeon server processors this fall, but future CPUs will be Haswell and
> Broadwell.
>
> Intel already has the next, next generation Skylake with SGX fabricated for
> testing.

but not released, and "enabling" means tied into X-KEYSCORE,
TRAFFICTHIEF, whatever else gets draped off UPSTREAM...



> I still think the document is talking about a dedicated crypto chip for VPN
> and SSL acceleration devices, just like it says.

the backdoors for all the other vendor hardware happened in years
prior.  HSMs and crypto accelerator gear is not exactly a vibrant or
competitive market.  in fact, these companies never seem to die, just
carry on with decent margins riding on incremental design upgrades
until they're bought out by a larger/growing competitor. ;)


of course, this could be because companies like Sun charge $9,999 for
an HSM/accelerator that is at best a reasonable cost at $1,499...




From coderman at gmail.com  Thu Dec 12 09:18:09 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 09:18:09 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1QWQAq1qtcihWkyH8B=OpafJYXJ2nb1ys+zyKWvG21jQg@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
 <CAJVRA1QWQAq1qtcihWkyH8B=OpafJYXJ2nb1ys+zyKWvG21jQg@mail.gmail.com>
Message-ID: <CAJVRA1RPYWA70GDZRk+bSzRmCYYq9gqZf3H8SX5+Ev=4U1NRtA@mail.gmail.com>

On Thu, Dec 12, 2013 at 8:42 AM, coderman <coderman at gmail.com> wrote:
>> IVB already shipped in 2012...
> only server Ivy Bridge: Xeon E3 in mid-2012.

this does bring up an interesting point:

while it may be more efficient to use the same "key" for the DRBG
output across all processor lines, it would be more secure to use a
different key per line.  this implies that each iteration of Sandy
Bridge -> Ivy Bridge -> Haswell needs to be "enabled" by CCP, with
Xeon E5 debut in 2013 as discussed.

for Sandy Bridge, this would have shown in 2010? and unless in network
equipment described simply as "enabling decryption for Sandy Bridge
used by $operating systems and $applications."

sadly we'll have to wait a while to confirm this conjecture for
Haswell.  and we'll have to wait forever for more leaks apparently, as
the continuing decline of details demonstrates...


best regards,




From matej.kovacic at owca.info  Thu Dec 12 00:20:03 2013
From: matej.kovacic at owca.info (Matej Kovacic)
Date: Thu, 12 Dec 2013 09:20:03 +0100
Subject: IndependenceKey?
Message-ID: <52A971B3.8050606@owca.info>

Hi,

just a quick question - anyone familiar with this:
http://www.independencekey.com/

or with the Swiss company Quantec, whis developed this product?

Regards,

M.




From coderman at gmail.com  Thu Dec 12 09:23:50 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 09:23:50 -0800
Subject: Fwd: [liberationtech] PrivateSky Takedown
In-Reply-To: <CANhci9ES6R3fObyMQ02aQOtLyaYmxERUGTsdRZhyi432+WR5zg@mail.gmail.com>
References: <CANhci9ES6R3fObyMQ02aQOtLyaYmxERUGTsdRZhyi432+WR5zg@mail.gmail.com>
Message-ID: <CAJVRA1RPgvzsLT4DWo7bVWJ0ZoL8T6nBz14ceuQBjQwQj+sF=Q@mail.gmail.com>

---------- Forwarded message ----------
From: Yosem Companys <companys at stanford.edu>
Date: Thu, Dec 12, 2013 at 9:07 AM
Subject: [liberationtech] PrivateSky Takedown


Certivox Asked That We Share Their Side of the Story on the PrivateSky Takedown.

YC



http://www.certivox.com/blog/bid/359788/The-real-story-on-the-PrivateSky-takedown

The real story on the PrivateSky takedown.

Posted by Brian Spector on Thu, Dec 12, 2013

With the story about our PrivateSky takedown now public, I want to
take the opportunity to clarify a few points in various articles that
have appeared since yesterday covering the story.

Some headlines strongly infer our friends at GCHQ "forced" us to take
PrivateSky down. That's not the case.

Secondly, a very important point wasn't printed. GCHQ couldn't, by
law, request a blanket back door on the system. There are a very rigid
set of controls that mean only specific individuals can come under
surveillance. The legal request for such surveillance has a due
process that must be stridently followed. At no time did I or anyone
at CertiVox talk about CertiVox in relation to any RIPA warrant, only
the generic process by which these warrants are served.

By saying "our friends at GCHQ", there is no facetiousness intended.
The team at CertiVox have the upmost respect for the folks we
interacted with at GCHQ. They took the due process I outlined in the
previous point very seriously. We found that as an organisation, and
every individual involved there, were as worried about a breach of
public trust as much as we are.

Finally, I believe very strongly the following should be a larger part
of the public discourse of these subjects. What everyone needs to
understand is that every developed democracy in the world, even where
privacy rights are enshrined to the maximum efficacy by statute, has
laws on the books that mandate that Internet Service Providers have
facilities to work with law enforcement for the purposes of legal
intercept, to enforce public safety and security.

Being L.I. capable is a very important set features and functions that
must be in place for any credible, commercial service on the Internet.
In endeavouring to make PrivateSky as secure as possible, we
overlooked this critical requirement when we built PrivateSky.

When CertiVox positioned PrivateSky as the easiest to use and most
secure encrypted messaging service, we really had two significant
points of differentiation. First, even though we held the root
encryption keys to the system, it was architected in such as way that
it would have been all but impossible for our internal staff to snoop
on our customer's communications, or for the service to leak any of
our customer¹s data. Secondly, our possession of the root keys, and
our use of identity based encryption, made the system incredibly easy
to use. For the user, there were no private or public keys to manage,
every workflow was handled for the user in an easy to grasp pure HTML5
interface, no hardware or software required, just an HTML5 browser.

We boxed ourselves into a feature set and market position that when
called upon to comply with legal statues, we simply had no alternative
but to shut the service down. We built it, but we couldn't host it.

Why? Because as you can probably surmise, there is an inherent
impedance mismatch between being able to host a commercial
communications service that gives the upmost in privacy to its users,
against any breach, whilst at the same time being able to operate
safely within the confines of the law as it is on the books in most
countries on the planet.

In summary, it's the abuse of the communications interception in the
Snowden revelations that has everyone up in arms, as so it should. But
that¹s not what happened with PrivateSky.

What is our next move?

Watch this space.
--
Liberationtech is public & archives are searchable on Google.
Violations of list guidelines will get you moderated:
https://mailman.stanford.edu/mailman/listinfo/liberationtech.
Unsubscribe, change to digest, or change password by emailing
moderator at companys at stanford.edu.




From jya at pipeline.com  Thu Dec 12 07:08:55 2013
From: jya at pipeline.com (John Young)
Date: Thu, 12 Dec 2013 10:08:55 -0500
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.g
 mail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
Message-ID: <E1Vr7s1-0004qb-PM@elasmtp-kukur.atl.sa.earthlink.net>

Please stop this suicidal, treacherous discussion. You're undermining
the global industry of weak crypto and comsec. That counts as economic
terrorism in all the countries who abide arms control, export control,
copyright, capitalism, heirarchical rule, suppression of dissent, lawful
spying, breaking and entering black jobs, ubiquitous spying on each other
and everybody else, in particular what NRO terms "unobservable
and unknown phenomena," and a lot of other secret stuff which can
only be revealed by low-ranked knobheads sure to be burned at the
stake by their cowardly protectors for the irresistable allure of IPO
millions based on government contracts to keep this shit among
us. Got that? This is a place to share fudging how it should work,
and does now and then. You think  this is bullshit, dontcha? Well, it
aint. Why look at the rising use of Tor, PFS, TLS, those rat-infested
private keyservers and millions of eaters of Symantec back-doored
dookie-pie. You seen any US producers of comsec go under yet?
No, and you wont, for they are locked into surefire global success
when failure is built into their products. Screwing customers and
citizens with faulty comsec, what's wrong with that, where you been,
that's patriotic, and damn profitable. Sure, call for outraged dissent,
fine, great, if that moves the ponzi, balloons those bitcoins.

At 09:08 AM 12/12/2013, coderman wrote:
>i see your skepticism, and i raise you a retort! ;)
>
>also, this year by end of year, in 2013 you expect to:
>- Make gains in enabling decryption and Computer Network Exploitation
>(CNE) access to fourth generation/Long Term Evolution (4GL/LTE)
>networks by inserting vulnerabilities.
>- Complete enabling for [well recognized name] encryption chips used
>in Virtual Private Network and Web encryption devices.
>and last but not least,
>- Shape the worldwide commercial cryptography marketplace to make it
>more tractable to advanced cryptanalytic capabilities being developed
>by NSA/CSS.
>
>Ok, given those requirements. Who fits the bill?





From adi at hexapodia.org  Thu Dec 12 13:24:37 2013
From: adi at hexapodia.org (Andy Isaacson)
Date: Thu, 12 Dec 2013 13:24:37 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
Message-ID: <20131212212437.GD6895@hexapodia.org>

On Thu, Dec 12, 2013 at 08:04:00AM -0800, Steve Weis wrote:
> On Dec 12, 2013 6:08 AM, "coderman" <coderman at gmail.com> wrote:
> > i see your skepticism, and i raise you a retort! ;)
> >
> > i even have a list of candidates you can experiment with to confirm
> > Intel Ivy Bridge as best fit. [0]
> 
> I think this is a weak guess.

In reply to Declan tweeting about this discussion (shame on you, Declan,
if you're reading this and trying to take the discussion to the public),
Kevin Poulsen points out
https://twitter.com/kpoulsen/status/411226939547222016
that the Times' comment on this redaction appears to imply that the
redacted text names two chips:

http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=0

    Large Internet companies use dedicated hardware to scramble traffic
    before it is sent. In 2013, the agency planned to be able to decode
    traffic that was encoded by one of these two encryption chips,
    either by working with the manufacturers of the chips to insert back
    doors or by exploiting a security flaw in the chips' design.

> The document is talking about FY2013.  IVB already shipped in 2012. I'd
> guess it was fabricated for testing in 2009-2010 and designed for a few
> years prior.
> 
> What enablement would be "complete" in 2013 for something that has been on
> the market a year and is already being phased out?

VPN gear lasts in the field for 2-5 years post roll-out.  Design wins
into large provider's hardware will often see the same chip being
manufactured for 2-5 years after it ceases being available at retail.
(ark.intel.com has an "embedded option available?" field to denote the
chips they support this for.)

"Complete Enablement" is jargon with a specific meaning.  I'm not
certain I understand it, but I *think* it means "we have plaintext
access on any targeted session".  I don't think it means "we can get
plaintext for an arbitrary previously recorded session" and I don't
think it means "we automatically get plaintext for every session we can
hear".  Suppose a NSA chip backdoor receives its triggering command by a
specific sequence of TCP retransmits (dropped packets) and after being
triggered, leaks the key by varying the timing or ordering of outbound
packets.  By my reading, this would count as "complete enablement" even
though a session which was not triggered would not be eavesdroppable.

To specifically respond to your point, "Complete enablement" is also
time dependent.  Productionizing a timing side channel attack could
result in complete enablement only for new flows and would still be
complete even though there was no enablement before the attack was
available.

> By 2013, Intel had already started shipping Haswell. They did launch new
> IVB E5v2 Xeon server processors this fall, but future CPUs will be Haswell
> and Broadwell.
> 
> Intel already has the next, next generation Skylake with SGX fabricated for
> testing.
> 
> I still think the document is talking about a dedicated crypto chip for VPN
> and SSL acceleration devices, just like it says.

Especially taking the NYT commentary into account, I'm even more
convinced you're right.  "Intel and AMD" is about the right length...

-andy




From coderman at gmail.com  Thu Dec 12 17:17:03 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 17:17:03 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <20131212212437.GD6895@hexapodia.org>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
 <20131212212437.GD6895@hexapodia.org>
Message-ID: <CAJVRA1SgUF1B2W61s9fP8QwiJCT-dLcqLoW3DaT+UjcCTP_LgA@mail.gmail.com>

On Thu, Dec 12, 2013 at 1:24 PM, Andy Isaacson <adi at hexapodia.org> wrote:
> ...
> In reply to Declan tweeting about this discussion (shame on you, Declan,
> if you're reading this and trying to take the discussion to the public),

the worst kind of xpost of all?

every day without RDRAW is another day of my life with provably less
information theoretic meaning.  ;)



> Kevin Poulsen points out
> https://twitter.com/kpoulsen/status/411226939547222016
> that the Times' comment on this redaction appears to imply that the
> redacted text names two chips:
>
> http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=0
>
>     Large Internet companies use dedicated hardware to scramble traffic
>     before it is sent. In 2013, the agency planned to be able to decode
>     traffic that was encoded by one of these two encryption chips,
>     either by working with the manufacturers of the chips to insert back
>     doors or by exploiting a security flaw in the chips' design.

two chips or two families or two architectures or ...
is this a game of twenty questions? can we do a reddit AMA for the
leakers with their stash at the ready?



> "Complete Enablement" is jargon

you know, if we had more documents providing context,



> Suppose a NSA chip backdoor receives its triggering command by a
> specific sequence of TCP retransmits (dropped packets) and after being
> triggered, leaks the key by varying the timing or ordering of outbound
> packets.  By my reading, this would count as "complete enablement" even
> though a session which was not triggered would not be eavesdroppable.

past experience tells us they like attacks universally effective,
unidirectional, silent/random-looking (without secret knowledge), and
don't mind expending custom hardware and algorithms to do it.
Dual_EC_DRBG doesn't count - that was a "jeezus, everyone asleep at
the wheel.  i bet we could get this approved!" moment.


triggering is active, observable (potentially), and usually
re-playable.  the only "delivered payloads", ala
EGOTISTICAL*/ERRONEOUS*, appear to be for confirmation pinging or
identification, and memory resident forensic/exfiltration run locally
on the host.  even the slides you link to note the OPSEC concerns of
"adversarial actors" (i think that's us on this list?)



> To specifically respond to your point, "Complete enablement" is also
> time dependent.  Productionizing a timing side channel attack could
> result in complete enablement only for new flows and would still be
> complete even though there was no enablement before the attack was
> available.

sure.  note how this is also more complicated, with higher risk?  if
there was a better way i bet they'd choose it!



> "Intel and AMD" is about the right length...

also, Intel and ARM, Apple and ARM, Apple and VIA, etc.
  you're not helping my pleading and cajoling for RDRAW sir.



on a related note, if Intel were to decide to include RDRAW in next
CPU line design, how long would it be to retail channels? >3yrs?




From coderman at gmail.com  Thu Dec 12 17:55:56 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 17:55:56 -0800
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CAJVRA1SgUF1B2W61s9fP8QwiJCT-dLcqLoW3DaT+UjcCTP_LgA@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
 <20131212212437.GD6895@hexapodia.org>
 <CAJVRA1SgUF1B2W61s9fP8QwiJCT-dLcqLoW3DaT+UjcCTP_LgA@mail.gmail.com>
Message-ID: <CAJVRA1R88-CX2Vmwq3AM9-KLi2V4cTC=X73jqtfNY6=+8XT5gQ@mail.gmail.com>

On Thu, Dec 12, 2013 at 5:17 PM, coderman <coderman at gmail.com> wrote:
> ...
> triggering is active, observable (potentially), and usually
> re-playable.  the only "delivered payloads", ala
> EGOTISTICAL*/ERRONEOUS*, appear to be for confirmation pinging or
> identification, and memory resident forensic/exfiltration run locally
> on the host.  even the slides you link to note the OPSEC concerns of
> "adversarial actors" (i think that's us on this list?)


correction: persistence after reboot also has been stated to be
performed, though optional.  per Bruce's write up[0],
1. target identified (at endpoint or observable mid-point)
2. QUANTUM INSERT redirect to FoxAcid server
3. FoxAcid picks loader exploit according to: target value, exploit
value, target skill, other factors.
4. Loader exploit delivered to target
5. confirm success?  if no, abort.
6. With loader active, run two basic first pass payloads:
7. Collect configuration information (apps, registry, settings, etc.)
8. Collect location information
9. Escalate to persistent infection, run arbitrary other plugins, etc.


in any case, this is more consumer endpoint focused.  not applicable
to embedded VPN/HTTPS devices.



0. Bruce Schneier's attacking Tor article for the Guardian:
 http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity




From coderman at gmail.com  Thu Dec 12 18:21:33 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 18:21:33 -0800
Subject: How long does it take to design and release a chip?
Message-ID: <CAJVRA1QZSS-Zfmacibx1uh1ruYYkVyw=1LCRvqwrgc_J-NKMwg@mail.gmail.com>

On Thu, Dec 12, 2013 at 5:17 PM, coderman <coderman at gmail.com> wrote:
> ... if Intel were to decide to include RDRAW in next
> CPU line design, how long would it be to retail channels? >3yrs?

using Sandy Bridge as a reference: 4 years design to demo, 1-2 years
demo to available.

design began 2005
demo'd in 2009
shipping in 2011




From coderman at gmail.com  Thu Dec 12 22:25:50 2013
From: coderman at gmail.com (coderman)
Date: Thu, 12 Dec 2013 22:25:50 -0800
Subject: Multiple Plots by US, UK to Kidnap Edward Snowden
Message-ID: <CAJVRA1TO=Vzb+PvSruOKw3RPoskyksSqYKUdaak+tP65MEioXw@mail.gmail.com>

ah FSB; you crack me up!

'''A senior officer of Russian counter-intelligence said: "Although
the Federal Security Bureau does not do anything about human rights
activist Snowden, the service has been active in counterintelligence.
I am pretty sure that kidnaping the former NSA employee will be
dramatically challenging." He also thanked "former NSA employees and
journalists for publishing such information...'''

---

http://english.pravda.ru/russia/politics/10-12-2013/126347-edward_snowden_russia_kidnapped-0/?mode=print
"""
Edward Snowden can be kidnapped from Russia?

10.12.2013 14:57

Edward Snowden, the whistleblower of NSA's total control systems can
be kidnapped from Russia. This is a priority for the British MI-6 and
the British Embassy, former NSA agent Wayne Madsen said, referring to
his colleagues.

Of course, nothing is known whether the CIA received the task, and
whether the U.S. Embassy is going to be involved in the activities to
try to kidnap Snowden. However, the British Embassy has already
tracked calls and letters of Snowden's "inner circle" and begun to
"dig up" their contacts in Moscow.

According to The Guardian, Snowden has the information, the disclosure
of which could become a nightmare for the U.S., even though the
fugitive NSA specialist decided not to disclose some of his data. In
addition, The Guardianadmitted that the media have so far published
"only 1%" of available information about NSA's total control over
billions of people in different countries.

Nevertheless, even this one percent has already made the UK
authorities introduce outright censorship against those who reveal
secrets of "global surveillance."

In particular, Wayne Madsen said that his girlfriend, who previously
worked for the National Security Agency as an expert on the Russian
language, tried to contact Snowden's acquaintances. Afterwards, she
was invited to come to the British Embassy and undergo special
training. She was also asked to report of FSB's interest in her
persons and communications.

The press quoted a former NSA expert, who said that the job to find
Snowden was of the highest priority for the embassy. Moreover, it was
said that the future operation to kidnap him involved number one MI-6
officer at the embassy, who worked under diplomatic cover as the
director for regional security.

The Center for the Study of Globalization has previously reported that
should the operation be successful, Snowden would be delivered to the
UK or the U.S. For the time being, the flywheel of total wiretapping
that Snowden launched was working against him to the utmost. "MI-6
intelligence agencies have begun to analyze the information they were
able to obtain through intelligence," the statement from the center
said.

A senior officer of Russian counter-intelligence, whom Politonline.ru
confidentially managed to talk to, said: "Although the Federal
Security Bureau does not do anything about human rights activist
Snowden, the service has been active in counterintelligence. I am
pretty sure that kidnaping the former NSA employee will be
dramatically challenging." He also thanked "former NSA employees and
journalists for publishing such information, but added that
operational, technical and other measures to counter intelligence and
other illegal activities of foreign secret services on the territory
of Russia were  constantly maintained.

It only remains to add that the CIA has recently created a special
section in Russian on its official website, in which the department
offered Russian citizens (!) to join American intelligence. To choose
from, for example, the CIA offers engineering and technical
directions, a linguistic job, a secret agent with the knowledge of
Russian language and experts in business and analysts. The CIA
reportedly hopes to obtain classified information from newcomers in
the above areas to establish a new database of agents.

"""




From janfrode at tanso.net  Fri Dec 13 02:32:28 2013
From: janfrode at tanso.net (Jan-Frode Myklebust)
Date: Fri, 13 Dec 2013 11:32:28 +0100
Subject: [cryptography] Which encryption chips are compromised?
In-Reply-To: <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <CACJAJ59bDHr58MsLN1=oHSKSumafJW3BGifsyx6obx=Vn4Ub0g@mail.gmail.com>
Message-ID: <20131213103228.GA12278@mushkin.tanso.net>

On Thu, Dec 12, 2013 at 08:04:00AM -0800, Steve Weis wrote:
> 
> The document is talking about FY2013.  IVB already shipped in 2012. I'd
> guess it was fabricated for testing in 2009-2010 and designed for a few
> years prior.
> 
> What enablement would be "complete" in 2013 for something that has been on
> the market a year and is already being phased out?

A microcode update ?



  -jf




From tom at ritter.vg  Fri Dec 13 19:31:21 2013
From: tom at ritter.vg (Tom Ritter)
Date: Fri, 13 Dec 2013 19:31:21 -0800
Subject: Joke
In-Reply-To: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
Message-ID: <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>

I doubt it - abuse through Tor is a legitimate problem.  Wikipedia blocks
editing from Tor for the same reason.

There are ideas for solving this though, and it would be cool to see more
ideas, and more fleshing out of them.  Mike Hearn has talked about having
people make a bitcoin deposit for an account, and after so much time of
legitimate use, the deposit is refunded.  Before that, if it's used for
abuse, the deposit is kept by the service.

-tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 531 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131213/d6128dfd/attachment.txt>

From coderman at gmail.com  Fri Dec 13 23:13:30 2013
From: coderman at gmail.com (coderman)
Date: Fri, 13 Dec 2013 23:13:30 -0800
Subject: BlueHat v13 crypto talks - request for leaks ;)
Message-ID: <CAJVRA1SHHrfuAi0oaOff3Cu3FRiy0g1VbUWLgQ0fvCPcMkUGjQ@mail.gmail.com>

any details on "Mackerel: A Progressive School of Cryptographic
Thought" or "The Factoring Dead: Surviving the Cryptopocalypse" ?




From juan.g71 at gmail.com  Fri Dec 13 18:22:03 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Fri, 13 Dec 2013 23:22:03 -0300
Subject: Joke
Message-ID: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>



	So, I tried to create an account at bitcointalk.org and got this

	"Due to abuse, registration through Tor is not permitted. "

	That's got to be a joke, right? right? 





From tom at ritter.vg  Sat Dec 14 02:55:13 2013
From: tom at ritter.vg (Tom Ritter)
Date: Sat, 14 Dec 2013 02:55:13 -0800
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <CAJVRA1SHHrfuAi0oaOff3Cu3FRiy0g1VbUWLgQ0fvCPcMkUGjQ@mail.gmail.com>
References: <CAJVRA1SHHrfuAi0oaOff3Cu3FRiy0g1VbUWLgQ0fvCPcMkUGjQ@mail.gmail.com>
Message-ID: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>

I can answer for Cryptopocalype. :)  I had a follow-up blog post after
Black Hat, but the crux is looking for the next crypto black swan. Joux's
work in optimizing the function field sieve for fields of a small
characteristic has been a significance improvement kind of out of left
field. If he or anyone else made improvements to the FFS for fields of a
large  characteristic or the GNFS - we would be in a bad way. The security
margin on the ECDLP is greater than DL or factoring and while we've got the
algorithms, the implementations are sometimes missing and the ability to
pivot, in software update mechanisms, in CAs, everywhere - is completely
missing. ECC has other attributes that make it attractive too, so let's get
the plumbing ready, so we can support a quick pivot away from RSA and over
to ECC if we have to.

I copied Justin rather than (poorly) summarize his work.

-tom

(Just landed, sent from the baggage claim, excuse brevity)
On Dec 14, 2013 2:24 AM, "coderman" <coderman at gmail.com> wrote:

> any details on "Mackerel: A Progressive School of Cryptographic
> Thought" or "The Factoring Dead: Surviving the Cryptopocalypse" ?
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1476 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/414ec680/attachment.txt>

From coderman at gmail.com  Sat Dec 14 03:12:10 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 03:12:10 -0800
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
References: <CAJVRA1SHHrfuAi0oaOff3Cu3FRiy0g1VbUWLgQ0fvCPcMkUGjQ@mail.gmail.com>
 <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
Message-ID: <CAJVRA1SP33TxH-RrHTgZ7R3uP17P-Zn9ttoh2DZu08hdH5d-RA@mail.gmail.com>

On Sat, Dec 14, 2013 at 2:55 AM, Tom Ritter <tom at ritter.vg> wrote:
> I can answer for Cryptopocalype. :)  I had a follow-up blog post after Black
> Hat, but the crux is looking for the next crypto black swan. Joux's work in
> optimizing the function field sieve for fields of a small  characteristic
> has been a significance improvement kind of out of left field. If he or
> anyone else made improvements to the FFS for fields of a large
> characteristic or the GNFS - we would be in a bad way. The security margin
> on the ECDLP is greater than DL or factoring and while we've got the
> algorithms, the implementations are sometimes missing and the ability to
> pivot, in software update mechanisms, in CAs, everywhere - is completely
> missing. ECC has other attributes that make it attractive too, so let's get
> the plumbing ready, so we can support a quick pivot away from RSA and over
> to ECC if we have to...


thanks!

for posterity, the post is at:
http://ritter.vg/blog-cryptopocalypse_followup.html




From coderman at gmail.com  Sat Dec 14 04:33:31 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 04:33:31 -0800
Subject: [Full-disclosure] RDRAND used directly when default engines loaded
 in openssl-1.0.1-beta1 through openssl-1.0.1e
Message-ID: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>

as per the FreeBSD announcement[0] and others[1][2] direct use of
RDRAND as sole entropy source is not recommended.

from Westmere onward you could use AES-NI to make crypto fast in
OpenSSL.  a common theme is to initialize OpenSSL via
ENGINE_load_builtin_engines() which lets OpenSSL take advantage of
this acceleration.

with Sandy Bridge you also got RDRAND. now load_builtin_engines
results in the application using RDRAND directly for all entropy, in
addition to accelerating AES.


if you are using an application linked with openssl-1.0.1-beta1
through openssl-1.0.1e you should do one of the following:

a.) rebuild your OpenSSL with OPENSSL_NO_RDRAND defined.

b.) call RAND_set_rand_engine(NULL) after ENGINE_load_builtin_engines().

c.) git pull latest openssl with commit: "Don't use rdrand engine as
default unless explicitly requested." - Dr. Stephen Henson

the OPENSSL_NO_RDRAND option is recommended; an inadvertent call to
load engines elsewhere could re-enable this bad rng behavior.


best regards,


0. "FreeBSD Developer Summit: Security Working Group, /dev/random"
  https://wiki.freebsd.org/201309DevSummit/Security

1. "Surreptitiously Tampering with Computer Chips"
  https://www.schneier.com/blog/archives/2013/09/surreptitiously.html

2. "How does the NSA break SSL? ... Weak random number generators"
  http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




From coderman at gmail.com  Sat Dec 14 06:42:55 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 06:42:55 -0800
Subject: cognitive dissonance in threat modelling?
In-Reply-To: <52AC63DF.2050605@iang.org>
References: <527F865A.7020703@iang.org>
 <20131211001137.892EA228094@palinka.tinho.net>
 <CAJVRA1S98s+DMzZdEUJ-71vyFgDZk49sUFCk5PBZdg1zDvmFzg@mail.gmail.com>
 <CACJAJ58MdvNtvDuE+AWCOm4MsEAd+YQGVLVbFaYCS6uGxcV_4g@mail.gmail.com>
 <20131212051537.GA20782@hexapodia.org>
 <CAJVRA1SWXcPvUKbCSmwO3Hw27G8Sy1GytidGUuLC7hUDdPjcrw@mail.gmail.com>
 <52AC63DF.2050605@iang.org>
Message-ID: <CAJVRA1Tf6PTS=P3oihw-3TPBOHhc3N=Lw4QWFdBoCF2vEAeUbw@mail.gmail.com>

On Sat, Dec 14, 2013 at 5:57 AM, ianG <iang at iang.org> wrote:
> ... the way in to a sector attack such as is now NSA's mission
> is often by picking the weaker player and perverting them. Then, leapfrog
> (with extortion & bribery) through other players.
>
> Also disturbing is that if the it is Intel, this would mark an intervention
> into the competitive marketplace of industrial policy proportions:  it would
> be promoting Intel over the competitors, which would basically undo decades
> of work to open markets to competition.
>
> Knowing what the NSA are up to is on the verge of becoming a global
> competitive priority.  From an economics / world trade pov, this is seismic.


i hope it was worth it for them!  'cause this is going to be expensive...


Matthew Green posted insights on how one might implement backdoors in chips:
  http://blog.cryptographyengineering.com/p/some-thoughts-on-suborning-encryption.html
as well as the "Weak random number generators" attacks:
  http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html



regarding the unredaction automation: the typographic interpolation
trick discussed on the list, matching type face with justified spacing
with candidate word(s), is a really annoying idea and won't get out of
my head.

 (i tried to distract and forget with a Tor patch -
https://trac.torproject.org/projects/tor/ticket/10402 - to no avail ;)

currently playing with scipy, skimage to:
- obtain from human initial document image
- obtain from human seed words / dictionary for matching
- misc. contrast / levels / etc conditioning for text optimized monochrome
- mask document image into text and non-text areas
- edge detect, align to horoz (for selections by x/y)
- broad region detect text rows into individual row images
- region detect individual chars per row image then assign char value via OCR
- insert human in loop to confirm / correct OCR row by row
- insert human to select redact line + redact area
- interpolate justified components: character spacing, word spacing, etc.
- iterate over known text with candidate fonts until best match.
- iterate over candidate words in best font until best match.
- success?  what confidence? (GOTO 10)
(the extra work for char by char and whole doc dis-assembly is in case
a "re-assemble scanned chars into candidate" rather than "match font
and re-produce text candidate" mode is needed.)

something better, Beuller?  ... Beuller?
... this won't be the last time i find this code useful!


current working set, including known wrong (please add suggestions :)
FeliCa and AMD
Nortel Networks
Apple and ARM
Array Networks
Cisco and Atmel
Philips and VIA
HiFn and Atmel
Cisco and ARM
Cisco and HiFn
Intel Ivy Bridge
Intel RDRAND
Atmel and IBM
Atmel and VIA
Apple and VIA
Intel and AMD
Intel and ARM
Forum Systems
VIA XSTORE
Cavium Nitrox
CAI Networks
A10 Networks
Cisco Systems
Citrix Systems
Sun SCA6000




From coderman at gmail.com  Sat Dec 14 08:40:34 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 08:40:34 -0800
Subject: [Full-disclosure] RDRAND used directly when default engines
 loaded in openssl-1.0.1-beta1 through openssl-1.0.1e
In-Reply-To: <00b501cef8e9$e4000cc0$ac002640$@acm.org>
References: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
 <00b501cef8e9$e4000cc0$ac002640$@acm.org>
Message-ID: <CAJVRA1T=oYE5NqV7Fi1jsOkn4Od80DjbdE8_upKmP7oPv0ppTw@mail.gmail.com>

On Sat, Dec 14, 2013 at 8:31 AM, Dennis E. Hamilton
<dennis.hamilton at acm.org> wrote:
> It would have been good if you had said "security issue" ...


i think the word you're looking for is "Feature".

... but you and me are not the customer.   ;)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




From coderman at gmail.com  Sat Dec 14 09:25:49 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 09:25:49 -0800
Subject: RDRAND used directly when default engines loaded in
 openssl-1.0.1-beta1 through openssl-1.0.1e
In-Reply-To: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
References: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
Message-ID: <CAJVRA1SdJoG1gh-hkT9CHaYwUkWWUUYeX=X=uefAYMdxwsdXxA@mail.gmail.com>

On Sat, Dec 14, 2013 at 4:33 AM, coderman <coderman at gmail.com> wrote:
> ...
> if you are using an application linked with openssl-1.0.1-beta1
> through openssl-1.0.1e you should do one of the following:
>...
> b.) call RAND_set_rand_engine(NULL) after ENGINE_load_builtin_engines().

correction:
this won't leave you vulnerable, but it will crash your app.  not
broken convention:

      /* If we are using a version of OpenSSL that supports native RDRAND
         make sure that we force disable its use as sole entropy source.
         See https://trac.torproject.org/projects/tor/ticket/10402 */
      if (SSLeay() > OPENSSL_V_SERIES(1,0,0)) {
        t = ENGINE_get_default_RAND();
        if (t &&
            (strcmp(ENGINE_get_id(t), "rdrand") == 0)) {
          log_warn(LD_CRYPTO, "OpenSSL is using RDRAND by default."
                   " Attempting to force disable.");
          ENGINE_unregister_RAND(t);
          ENGINE_register_all_complete();
        }
      }

see https://peertech.org/dist/tor-latest-rdrand-disable.patch


best regards,




From coderman at gmail.com  Sat Dec 14 10:36:56 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 10:36:56 -0800
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed by
 Stewart Baker
Message-ID: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>

this is pretty amusing :P

(and needs a "Knuth is my Homeboy" homage?)

---

http://bendrath.blogspot.be/2013/12/layers-of-struggle-privacy-vs.html

Layers of the struggle privacy vs surveillance, in my picture of the year

This is the picture of the year for me, on so many different layers:
  [view the image directly via:
   https://pbs.twimg.com/media/BbYqgdMIgAAX7Wk.jpg ]
Stewart Baker, ex-NSA general counsel, and Jacob Appelbaum, internet
freedom activist/hacker/journalist (left, right).

They pretty much symbolise the two sides of the global scandal of the year.

They also symbolise the attitudes of both sides.
.
.
.




From bill.stewart at pobox.com  Sat Dec 14 11:52:38 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Sat, 14 Dec 2013 11:52:38 -0800
Subject: Gmail's receiving mostly authenticated email
Message-ID: <20131214213326.56CD5F435@a-pb-sasl-quonix.pobox.com>

Saw an interesting article from Gmail on their inbound email statistics.
Over 91% is authenticated with either DKIM or SPF.  75% is both, the 
rest is one or the other.
That doesn't indicate how much is encrypted, but anything that has 
the framework to do that authentication could fetch a key as well.
(Doesn't stop the feds from collecting the mail after Gmail receives 
it, of course, but it's an indication of how much email could 
relatively easily add some encryption to reduce in-transit eavesdropping.)




From albill at openbuddha.com  Sat Dec 14 12:26:10 2013
From: albill at openbuddha.com (Al Jigong Billings)
Date: Sat, 14 Dec 2013 12:26:10 -0800
Subject: Joke
In-Reply-To: <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
 <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
Message-ID: <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>

Do you ever have anything positive or nice to say, Juan?

On Saturday, December 14, 2013, Juan Garofalo wrote:

>
>
> --On Friday, December 13, 2013 7:31 PM -0800 Tom Ritter <tom at ritter.vg<javascript:;>
> >
> wrote:
>
> > I doubt it - abuse through Tor is a legitimate problem.
>
>
>         Not sure what that means. At any rate, there seems to be something
> wrong
> with the bitcoin forum blocking anonymous(sort-of) access, no?
>
>
>
>
>
> > Wikipedia blocks
> > editing from Tor for the same reason.
>
>
>         ah, wikipedia....
>
>
> >
> > There are ideas for solving this though, and it would be cool to see more
> > ideas, and more fleshing out of them.  Mike Hearn has talked about having
> > people make a bitcoin deposit for an account, and after so much time of
> > legitimate use, the deposit is refunded.
>
>
>         Legitimate use? Such as? Parroting whatever garbge the 'wikipedia
> editors'
> say it must be parroted?
>
>
> > Before that, if it's used for
> > abuse, the deposit is kept by the service.
>
>         That's cool. So, say something those idiots don't like, and they
> 'keep'
> (steal) your money.
>
>
>
>
> >
> > -tom
> >
>
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1558 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/a14747e6/attachment.txt>

From albill at openbuddha.com  Sat Dec 14 13:30:05 2013
From: albill at openbuddha.com (Al Billings)
Date: Sat, 14 Dec 2013 13:30:05 -0800
Subject: Joke
In-Reply-To: <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
 <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
 <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>
 <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52accddd.579478fe.1da5@Al-Retina.local>

From: Juan Garofalo Juan Garofalo

> Do you ever have anything positive or nice to say, Juan? 


Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you 
think I should be licking? 

Any that make you grow up into a human being that isn’t an asshole?

-- 
Al Billings
http://makehacklearn.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4289 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/bfe8a26f/attachment.txt>

From albill at openbuddha.com  Sat Dec 14 13:30:46 2013
From: albill at openbuddha.com (Al Billings)
Date: Sat, 14 Dec 2013 13:30:46 -0800
Subject: Joke
In-Reply-To: <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
 <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
 <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>
 <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
 <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52acce06.3dc240fb.1da5@Al-Retina.local>

Frankly, you sound like an angry 19 year old who lives with his mom.

From: Juan Garofalo Juan Garofalo

Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you 
think I should be licking? 
-- 
Al Billings
http://makehacklearn.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2725 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/56b314fb/attachment.txt>

From coderman at gmail.com  Sat Dec 14 13:52:13 2013
From: coderman at gmail.com (coderman)
Date: Sat, 14 Dec 2013 13:52:13 -0800
Subject: c4-r3kN.txt (urls)
In-Reply-To: <CADhsnxdU3mJGuCTr+jyJmjnfEQ7avyCHTnd2fNLAGg9W3TNe2Q@mail.gmail.com>
References: <CADhsnxdU3mJGuCTr+jyJmjnfEQ7avyCHTnd2fNLAGg9W3TNe2Q@mail.gmail.com>
Message-ID: <CAJVRA1Qf+QqiigmLnrK3mL7mS06xUf+G8_Ycw_ceZmKhXZb=WA@mail.gmail.com>

On Sat, Dec 14, 2013 at 12:33 PM, brian carroll
<electromagnetize at gmail.com> wrote:
> ...
>  The Future
>
> "Modern cryptographic equipment consists of nothing more than a 'black
> box' with powerful digital processors and advanced mathematical
> algorithms. There is not much to see, and there are definitely no
> moving parts. We realize that this is probably where our collection of
> historical cipher equipment will end. However, there are numerous
> earlier cipher machines and much of this is still undiscovered. 'New'
> old machines will, no doubt, pup-up and many side-tracks will be
> walked. Furthermore, the history of some famous cipher machines is
> still very clouded, leaving much to be researched and much to be
> discovered in the years to come.
>
> "On the Crypto Museum website, we have done our best to raise an
> interest in historical cipher machines and cryptology in general.
> Where possible, we will give as much background information as we can.
> Perhaps you too will eventually get contaminated with the Crypto
> Virus. If it happens, be careful as it might get under your skein.


there are variations... i am afflicted with the contagious and acute
Entropus Major virus.  and now, any crypto system of which i am not
able to see the input randomness, by precision jitters or max rate
sampled freewheelers, or even that crazy faraday'ed up leadzone with
Geiger counter she told you about at BSides,

but hide that sweet sweet river of unrelated bits behind a bytecode
block??  that's just not cool!

until then, i've "borrowed" Peter G's d20's for a bit - hope he
doesn't need to roll them any time soon.
 ;P



> == random ==
> 1. if prohibition of alcohol = control of speech, as a side-effect,
> via behavioral influence, that is, sobriety;

i never considered prohibition as constraint on state of mind in public,
mainly thinking along monetary and covert economic activity angles.

but considering the public, and the multitudes of social scenes no
longer "lubricated" or under shadow of persecution, this would have a
direct and personal impact on many.

certainly a world removed from the producers and distribution
activity, which tends to monopolize the zeitgeist of the prohibition
era.




> what is prohibition of
> crypto? control of controversial thoughts and connections, an indirect
> form of secondary censorship. Fahrenheit 451 tactics- actual crypto
> the fire.

crypto-compromise as frantic inferno is not quite right.,
the impact is almost invisible, until it is dire and potentially life-ruining.

global compromise for ever-present surveillance is crypto-HIV
 sure, you're fine now.  probably a while, no concerning symptoms.

then OMGWTFBBQ punctuated equilibrium, over-reaction,
suddenly crypto-AIDS just ate your life and shat out
 terminal-solitary-confinement and/or financial ruin.

plenty of company with all the other susceptible individuals, more than
you imaged...  equally destroyed by a silent corrupter too easy to ignore

ETOOLATE



> 2. if everything is backdoored already, essentially key escrow exists
> as the basic situation, instead of having private keys the NSA has a
> master key per standard, implementation, other. if this was inside a
> known legal framework, that perhaps would be tolerable with oversight,
> yet without oversight where tyranny takes over, then everything is
> pawned/owned by NSA who could forcibly censor without consequence as
> part of a hidden political strategy, etc.
> (all tools broken so a crypto scheme can function, leading to all
> tools remotely breakable?)

they call it "Tailored Access" and "Computer Network Exploitation" for
"enabling".
... when they aren't having the FBI violating domestic providers in
their NSL hole.

it's legit.



on a more serious note, regarding the assumption:
 "if everything is backdoored already, essentially key escrow exists"

NSA has stated that many of their BULLRUN techniques are incredibly
fragile.  a number of them now burned in leaks, many yet to get
stuffed. if they "did it risky"[0], perhaps feeling emboldened by the
seeming success of Dual_EC_DRBG and friends, a common key / reduction
hidden behind AES-128 rounds could be discovered, independently
confirmed, and properly attributed.

so not only can the backdoors be broken up, replacements which are
resistant to compromise will take their stead.  "everything" becomes
"much" becomes "very little" until ideally such invasive tactics are
reserved for HUMINT tasked "good ol'e detective work" with legal
bonafides judged according to public laws and applicable to all
persons on earth, not just tribal deference pointed inward.

the jury is out; there are encouraging signs... but first, back to
those raw samples!!



best regards,



0. "Some thoughts on suborning encryption chips"
  http://blog.cryptographyengineering.com/p/some-thoughts-on-suborning-encryption.html
"""
A much easier approach is to simply eschew safety altogether and use a
fixed AES key that's common to all chips.
  [ED: or fixed modification to the AES-CBC-MAC compressor then masked
by the DRBG in front using "Stealthy Dopant-Level Hardware Trojans."]

But the NSA would never do something that risky. Right?
"""




From grarpamp at gmail.com  Sat Dec 14 10:56:02 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sat, 14 Dec 2013 13:56:02 -0500
Subject: Jacob impervious to "Rubber Hose Cryptanalysis" performed by
 Stewart Baker
In-Reply-To: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
References: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
Message-ID: <CAD2Ti28=5QWFNGdmV45-Gi1ieqhgXdkr352vhWL7bwgONA-1UQ@mail.gmail.com>

> this is pretty amusing :P

Perfect :) Wonder if the panel talk is online?




From electromagnetize at gmail.com  Sat Dec 14 12:33:28 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 14 Dec 2013 14:33:28 -0600
Subject: c4-r3kN.txt (urls)
Message-ID: <CADhsnxdU3mJGuCTr+jyJmjnfEQ7avyCHTnd2fNLAGg9W3TNe2Q@mail.gmail.com>

../correction_regarding; = "last {urls} list", a needed clarification
about applied concrete, its also massive and important role in
reconceptualization. bridges, hi-ways, skyscrapers along with steel,
office parks via CMUs. innovative material- and form-based aesthetics
(its own language or dialect, syntax, grammar, etc). medium for ideas,
shapes ideas, opens up new areas for development & interpretation.
(note: basis for approach of Le Corbusier (aka 'the crow'),
structure/order- 'organizational logic' as parti; and FLlW use of
concrete masonry units and precast concrete as vital to new ideas).
yet architecture is still much more than these things, it remains a
detail, sometimes of major significance other times not in the 'ideas'
involved. sometimes innovative, etc. yet in a larger context or
situation, larger goals and functioning than just concrete itself,
alone, as the variable. in other words 'the ideas of architecture' are
not containable just within concrete, though it can and does have
major influence at certain stages and within specific approaches. its
conceptual innovation feeds into architecture and vice-versa,
symbiotic, including conceptual stagnation due to loss of larger
vision (ideas) and greater purpose at scales involved due to
narrowed_focus(), etc(etc).


Crypto Museum
http://www.cryptomuseum.com/
http://www.cryptomuseum.com/mission.htm

 The Future

"Modern cryptographic equipment consists of nothing more than a 'black
box' with powerful digital processors and advanced mathematical
algorithms. There is not much to see, and there are definitely no
moving parts. We realize that this is probably where our collection of
historical cipher equipment will end. However, there are numerous
earlier cipher machines and much of this is still undiscovered. 'New'
old machines will, no doubt, pup-up and many side-tracks will be
walked. Furthermore, the history of some famous cipher machines is
still very clouded, leaving much to be researched and much to be
discovered in the years to come.

"On the Crypto Museum website, we have done our best to raise an
interest in historical cipher machines and cryptology in general.
Where possible, we will give as much background information as we can.
Perhaps you too will eventually get contaminated with the Crypto
Virus. If it happens, be careful as it might get under your skin.

August 2010,

Paul Reuvers & Marc Simons

/unquote



[video] Fully functional loudspeaker is 3-D printed
http://phys.org/news/2013-12-fully-functional-loudspeaker-d.html

"Lipson said he hopes this simple demonstration is just the "tip of
the iceberg." 3-D printing technology could be moving from printing
passive parts toward printing active, integrated systems, he said."



Airline Runways renumbered when Earth's Magnetic field shifts...
http://gizmodo.com/why-we-renumber-runways-when-the-earths-magnetic-field-1482779621



// see video. only 6 weeks to claim universal empirical effects...

The Mozart Effect myth: research finds music doesn't make you smarter
http://www.theverge.com/2013/12/12/5204124/the-mozart-effect-myth-research-finds-music-doesnt-make-you-smarter

(note: headline made me wonder what the difference actually is in
terms of intelligence or ability to think and process information in a
different conceptual framework/model, from those who actually _play
music, to those who are _trained to remotely  reproduce "music", say
musical compositions repeated for 240 years from the institutionalized
cultural canon, versus making your own music, exploring musical
principles versus rote behaviorism that may remove those learning
principles from the interaction, so people as tape recorders in a
context of music playback, repeating someone elses musical learning,
versus developing their own via unique exploration and grounding. the
latter approach would seem to indicate 'new information' models could
develop whereas repetition of preexisting structures and approaches
may limit this to a realm of memorization, for instance. likewise, any
effects from playing music may require longer-term integration to be
expressed as intelligence, years even, as motor skills and new
neuronal connections and pathways take hold, rewiring the brain, and
six weeks is not going to allow this known and basic benefit to be
evaluated. it may be a time of peak confusion, instead, because it is
new knowledge not yet integrated so to test on that is to force its
benefits into a realm of observable tangibility it may not be able to
provide, though may still exist as this inside people, expressing
itself over a longer time.)



Alligators and Crocodiles Use Tools to Hunt, in a First // via digg
http://www.livescience.com/41898-alligators-crocodiles-use-tools.html


Stealth maneuver allows nectar bats to target insect prey
http://phys.org/news/2013-12-stealth-maneuver-nectar-insect-prey.html

"The results, published in the journal Functional Ecology, show that
the bat's echolocation calls were high in frequency but low in
intensity making it difficult for {'bat-detecting ears' of} the insect
to detect the imminent danger.


Man Walks All Day to Create Massive Snow Patterns // via hh
http://www.mymodernmet.com/profiles/blogs/simon-beck-snow-art-update-2
https://www.facebook.com/snowart8848/photos_stream



:-:-:-: Ten books - Vitruvius, recontextualization :-:-:-:

i wanted to substantiate an approach to crypto in a larger context
from its parallel within architecture as a discipline that involves
real-time development based on principles that are shared as a
framework and value system, in other words common consciousness about
a given domain or areas of importance or relevance as this effects
what can or cannot develop.

in the existing late 20th c. worldview my research interests into
electrification as critical to understanding the existing built
environment had no place within the history books. such views are
literally erased, censored from books, both as content though also
imagery, there are few 'electrical poles' in those fashion photographs
of buildings, removing the ubiquitous context of infrastructure, as if
they function in a more pure condition than are reliant upon an
external source of power, light, heat, than 'the elements' of nature
and sunlight. because those are the beliefs, shade shadow mass spatial
experience, pre-electric, communication about experience shared in a
context of 'the senses' removed of their electromagnetic truth, such
that ungrounded subjectivism and indoctrination into a world view is
established and _must be followed to succeed in the systematized view
and training to become an architect, within such narrowed parameters.
to continue to extend the existing ideology in this way.

so it was necessary to find justification for such thinking and
consideration, and Plato offers this in terms of conceptualizing the
state as a body, essentially a nervous system. and then considering
this in terms of its governance. how the individual and group are
established via various principles of relation, what is prioritized,
etc.

there were also many fragmentary views from Modernist masters relating
to electrical aesthetics, i think it was Walter Gropius who related
the eyeball to the television set, and Le Corbusier had great interest
in the aesthetics of electrification, generators, motors, turbines.
and so an archaeological aspect, yet not integrated into a larger
framework. so as it happens, this continues to a threshold where
scholar-architects Venturi, Scott-Brown, and Izenour share very
insightful observations about the developing electromagnetic
landscape, to include such aesthetics of infrastructure relied upon
(in the desert no less, for life sustaining a/c and casinos and
signage: essentially OASIS and MIRAGE), in their Learning from Las
Vegas and yet the strong and silent type still does not mention or
investigate the electrical order while certainly referencing it and
including it within the chaos of the built environment in the
photographs taken. and yet, in architectural history, there is
supposedly no precedent, no way to make the case that this
infrastructure is an extension of architecture, of fundamental and
foundational relation as an ordering device within the city grid, its
planned development (ala plug-in city, though originating millennia
ago). and yet there is direct lineage with these billboards along the
highway that cars drive by and signage along busy routes near ancient
cities, the present day is an extension of similar structure and order
over a long span of time. it is part of a language, although it may
become subconscious, mediated in other terms or only indirectly, else
could be edited out as 'not architecture' which is the default
loophole.

(http://mitpress.mit.edu/books/learning-las-vegas)

what interested me about this, and i am not sure exactly the sequence
my readings occurred, though in deciding to delve into reading a
classic work of literature, the earliest account of architectural
authority (in the West) in terms of its classical culture and
development, if not mistaken, is that it was unlike the existing
conception of what architecture is, and had a far wider boundary for
knowledge and interpretation that today has been narrowed by special
and private interests in a 'training approach' to office workers than
an educational approach that questioned the parameters of
architecture, beyond a confined technical enterprise that overlaps
aesthetics onto a deterministic approach to answered problems of
culture, society, economic development, and political agendas driving
the development, its destructiveness.

Ten Books on Architecture - Vitruvius
http://en.wikipedia.org/wiki/De_architectura

so what took me by surprise is that the architect is speaking of not
only geometry and the proportion of temples and buildings at that
time, based on the classical ordering systems...

(Classical Orders: Doric, Ionic, Corinthian, Tuscan, Composite)
http://en.wikipedia.org/wiki/Classical_order

...though also about armaments and fortifications, about the quality
of water in wells (wells that produce black bile or something along
these lines), and various other important areas of knowledge in terms
of buildings and development in their larger realm of functioning,
which today would include areas like environment and defense as part
of this architectural inquiry and area of knowledge- for how
architecture exists and functions. In this way, to understand nature
and surrounding culture, infrastructure would fit into this same
approach, and without it the existing dwellings, buildings, the entire
built environment, cities themselves- do not make any sense because
they cease to function without electricity. A skyscraper no longer
functions in this era without electrical elevators and ventilation
systems, lighting, etc. A home would lose its washing machine, food
storage, communications ability, etc. And yet this vital and basic
information is left out of the equation, removed from architecture as
a viewpoint, which is ridiculous, and not allowed in 'reasoning'
within the schools likewise. In this way the ideas of architecture are
shallow, hollowed out of their meaning for a surface-based
interpretation, which serves a particular oil-based development agenda
perfectly.

the reason this was introduced here is because of ancient principles
now absent within the realm of architecture: approximated as
Commidity, Firmness, and Delight... these principles are often
presumed or claimed to exist for the given approach to image-based
development yet have become signage-only, language game seeking to
misrepresent what is going on, as if more is occurring, higher minded
activity than a base activity under the guise of architecture

Commodity, Firmness, and Delight, or Toward a New Architectural Attitude
http://classicistne.wordpress.com/2010/12/13/commodity-firmness-and-delight-or-toward-a-new-architectural-attitude/

(for instance, commodity replaced by anti-economy as 'economics';
firmness by using false foundation and understanding for development,
thus developing ungrounded civilization, and 'bliss of ignorance'
delight while this process is being subverted for ulterior motives).
There is misalignment and misrepresentation and short-circuiting and a
sabotaged detour going on within the ancient_tradition of
architecture, whereby today is functions directly against and in
opposition to these principles, most especially in the area they could
be evaluated and-or acknowledged, within the education system which
instead is ruled by an anti-architecture ideology. against thought,
against action, functioning against truth, grounded reasoning itself.

and then one day recently in trying to remember the above tripartite
concept, the mingling of its present incarnation as Fear, Uncertainty,
Doubt appeared in the fog of my mind, though was rendered as: Fear,
Uncertainty, and Delight, instead. and to me this illuminated this
very closely correlated development, removed of its camouflage, suc
that FUD is the equivalent set of principles by which development
occurs in a context of developing of this insecurity, uncertainty, and
incapacitation of people, most notably through ideology of relativism
and binary views based on biased authority structures and control over
reasoning and feedback.

another sample of wreckage from this same broken brain is that of the
Fountainhead by Ayn Rand, the book and also the excellent movie
(c.1949) with Gary Cooper and Patricia Neal.

http://en.wikipedia.org/wiki/The_Fountainhead
http://en.wikipedia.org/wiki/The_Fountainhead_%28film%29

there is controversy over interpretation of the ideas involved, though
i think an accurate grounding of observation neutralizes the beliefs,
when truth is the arbiter of actions and not just ego, as if belief in
superior vision is justification for higher awareness development that
others just cannot understand and thus lone geniuses stand alone in
obscurity, which then is how the corruption of the star system occurs
with celebrity architecture and development of 'aesthetic buildings'
are removed from larger issues of economics, societal, and their
political reliance and extension of given systems of corrupt power,
instead of questioning these, and thus in some sense 'the cathedrals'
built represent these values, as if glossy advertisements for a
culture devoid of culture, just about shiny objects and immediate
sensory experience that no longer connects with larger surrounding
issues or has a larger impact on lives than in an ecological negative,
like playing music on the titanic as it is sinking,  yet not
accounting for this part of the situation, as if heightened experience
when instead blindness. the entire system supporting this development,
all students, interning as peasants to upkeep offices that churn out
cultural pablum as if 'high conceptualization' when devoid of this, in
truth. then the conceit of the architect in this domain, as if
knowledgeable of what is going on as if in continuance of vitrivuian
awareness, or mastery within the built environment, when basic
reasoning and observation long ago failed in order to support the
ruling oppressive ideology.

so here is the contrast, the other way of considering this: that the
architect who removes themselves from the process of development as an
individual (i.e. human), then revolves around the issue of identity,
awareness, self-conception. issues of governance, models of the state
from individual to group, such that a 'shared identity' (humans) could
be this same individual and may have removed themselves from the
existing treachery, allowed this process of devolution to occur, and
thus the absence of architecture, its truth, then can be made evident,
the lack of culture in those 'representing culture' as stand-ins,
mimics, of a false order and false reality and false perspective
sustained and relied upon for the shallow relations based on another
foundation or set of parameters: say, base materialism, money.

further, 'the architect' may be assumed to thus be one person, one
individual, yet in this way a shared identity can compose this person,
such that the person is human, and as others are also human, they too
are involved in this condition, via shared awareness and values. thus,
a networking of realization or shared state as it were, via whatever
conceptual scaffolding or consciousness is sustained as entablature,
such that wave-collapse does not occur, and the post-and-lintel
connections between here and there are sustained between human beings.

likewise and vitally important, that 'architecture' is a
meta-condition as exampled by ancient conception that ranges beyond
the existing modeling, yet is fragmented and not integrated as a total
discipline in this way. naval architecture is one aspect,
traditionally, though also computer architecture and other areas. the
principles or even code, common structures, and programming (such
that, for instance, music and architecture are closely empirically
related, and essentially everything is, in terms of aesthetics in
terms of its truth and intelligence), then a wider range of activity
may be occuring as 'architecture' than is accounted for, and yet it
may be the truth of its condition, as certain principles are or are
not observed and served. for instance, serving public interest by
having safe water and waste disposal infrastructure versus relying on
toxic systems that despoil the environment, or stewardary of wildlife
and landscape and environments as this relates to weather and
ecosystems or denying these or exploiting them, say with engineering
weather for political manevering and strategy, and to enact certain
development patterns via forced desertification and manipulating
demographic and other flow patterns, as this can become an illegal
basis for creating and sustaining power, off the books, because it is
not included in the observations or analysis, unaccounted for.

further, that any 'architecture' is not at the hand and mind just of
the architect, though in its *implementation*, involving all who are
involved in its development, relying upon a shared awareness and value
system (truth) else subverted in its conception, communication, and
construction, by sabotage or other mistakes, errors, or misalignments
that weaken it. and thus the coherence in the group action to build
something upon a foundation, and how this is achieved, from idea to
its actualization (just like circuitry in technological devices that
then can break in or out of warranty via poor manufacturing or
deceitful practices baked-in).

it is this myth of completely independent action, that the individual
achieves something in its entirely -alone- that is a clean-room
conceptualization of a process that involves many who are part of the
larger process of design, construction, and development, and that this
'functioning together as one' is in some sense 'the architect' in its
larger coherent state, of shared awareness, continuum throughout the
various circuitry that establishes and sustains relations in their
truth, in the shared direction, moving together towards the same
goals. each person having an important role, each part having its own
importance in achieving functioning of the larger integerated whole.
not just as a machine, as a culture, as an idea though further- a
living idea, a living truth that is shared, that governs, principles
that are not merely referred to and referenced as if authority, and
instead, awareness and understanding that is based within and upon
knowing, a way of being or competency that develops in each as a
unique vantage of the common situation, another perspective yet
contributing toward a total perspective, allowing error correction and
greater accuracy than any single viewpoint.

in this way the people who create the materials are part of the
building process, part of the vital development of civilization and
culture, those who construct buildings and systems and develop this
order are vital for its implementation and have feedback and insight
to offer as part of this process, for how given approaches could be
improved or made more economical or with greater strength or
durability.

in this way, this coordinated empirical shared effort of many
functioning as one, to include engineers, designers, craftspeople,
tradespeople, workers, manufacturers, technologists, scientists, and
others, including programmers and security developers --- all of these
people are involved in the 'ideas' of architecture, as it is
integrated beyond narrowed boundaries and considered as a larger
conceptual model of how it actually functions, when accounting for its
various and many details and manifestations and dimensions that must
be developed, designed, built, and implemented correctly and
successfully, for the project to have integrity. to be able to endure
over time and function correctly, versus being designed and developed
to fall apart as today via any number of compromises or unshared
goals, lowered principle.

in other words, the potential exists that 'the architect' is in this
larger scale and framework of shared activity amongst many functioning
as one, and that no single person could feasibly be functioning in all
these domains, (unless extraordinary circumstances of all-knowing,
then all truth would be addressed not ignored in the building process,
tending towards utopia).

this is to suggest that 'architecture' could be occurring within a
wide range of realms that are not yet integrated in a larger
conception, conceptualization, or modeling accurately maps to its true
nature and functioning, its inherent interdisciplinary awareness that
integrates into a cohesive understanding spanning these various
domains. and lacking this, the conceit would be that a person could
know more than a tiny fragment of this immensity and alone be able to
shape all of these forces and meld them into a direction as an
individual, because of their truth, instead of having this be an issue
of 'shared identity' of those like who also relate to the situation in
similar dimensions and together can move towards a given direction as
one entity, diverse and multiplicitous yet organized, gaining not
losing coherence- order. and in this way, perhaps a context of entropy
and ideas, likewise, and security issues involved.

(in other words: it is not ungrounded group ego detached from or
ignoring 'truth' that is this shared momentum as development, nor of
an individual that is part of this. such that each pseudo-work is
considered 'the great work' that amounts to mediocrity, if analyzed
further beyond narrowed boundary. instead, of integrity, foundation
common to action, verified and sustained and modeled in its truth, in
service to it, then each point relating to others, lineage from one
structuring to the next, nodes interconnecting within dimensions, this
awareness, then interactions that build upon this stability, this
accurate understanding and modeling, such that it is a common or
shared development, it benefits the whole and the part and each is in
service to the truth of others who are operating within shared
principles, dimensions, and then learning from others, integrating
views, understanding, awareness, evolving a higher capacity and
improving, optimizing functioning, relation, communication, ability to
operate with cohesion yet still error-correct. what are the rules,
logic, truth, reasoning, falsifiability, the ability of debate to lead
to win-win interactions even while in contest because truth benefits
all through its discovery and development, new social dynamics and
understanding and awareness based on this, difficulties faced
betwixt-and-between as the conflict or friction is extreme, working
through the wrong models or moving through the false concepts or
limitations, breaking things down, pain and agony of not knowing or
having limited questioning and then requestioning, losing certainty,
only to regain basic truth and model for any interaction, governance
versus politics, basic versus applied, novice vs. expert, and role of
learning and literacy and basic questions as the place this
functioning occurs, as people move together towards a higher-order or
dimensional integration, over time...)


== sidenote A ==

note: i am not familiar with the indepth reasoning of Rem Koolhaas
related to ~shopping as a cultural activity though to me it cracked a
nut that opens a new universe of analysis about the actual behavior of
people in terms of material culture, social relations, etc. in that it
provides a context for evaluations on par with anthropology and
archeology, of the present situation.

review: The Harvard Design School Guide to Shopping
http://www.nytimes.com/2001/12/16/style/a-harvard-shopping-guide-charge-it.html

so this is meant to provide context for the following ideas... that
is, there is more to gain from a commercial advertisement in its
cultural depth than just a monetary transaction. (this moves into the
business page of daily newspapers as a tally of ongoing applied
philosophy, where business philosophy is the presiding worldview, the
shared communication that most effects the transformation and
development of culture- as ideas. (moreso: ideology though, as many
sacred beliefs are unquestionable and most things occur in such rigid
frameworks, ungrounded from external variables and falsifications, so
essentially protected views that can be and are weak structurally,
though within a bubble civilization seem peak insight).

beyond scaling of unchecked materialism and profit-based onesided
exchange (of beliefs) there can be lots going on in the development of
material artifacts, processes, as these effect social relations,
activities, various detailing of or within culture, in given sets of
parameters.

of the basic situation then of commerce, exchange, things that are
conceived of, invented or extended, -made-, developed into systems
small and large, then of the corresponding ideas attached to them,
that move alongside the movement of artifacts as they located in
culture, and find their place. as if shards of pottery someday to be
unearthed in various geographies that then matches a common culture
across distances and differences, via such evidence.

then to encounter such an advertisement:

DIGITAL MIND, ANALOG SOUL
http://www.blogcdn.com/www.engadget.com/media/2012/11/analogfourhtsynth92.jpg

rel. [video] Elektron announces Analog Four synthesizer
http://www.engadget.com/2012/11/13/elektron-announces-analog-four-synthesizer/

SOS review
http://www.soundonsound.com/sos/may13/articles/elektron-analog-four.htm

what was remarkable to me, having memory issues, is how research into
a drum machine (a related product on the company site) then led to a
graphic about another music tool that went high concept, into a realm
of big ideas and reminded me of the question i repeatedly wonder about
and then forget, once having known the basic situation....

part of the human nervous system is actually digital and part of it is
analog. and to me this is an important fact about the technological
environment people are living within, especially in terms of sensing
and how coupling with external signals and communications or
exfiltration of biological or physiological information could occur,
if not aspects of remote control over the nervous system via these
same means. and yet as shared view or model of humanity to discuss
ongoing oppressive dynamics in worse-case scenarios- non-existent! not
awareness or understanding except within a field of expertise that is
often politicized, such that there are agendas within professions;
political science -> political medicine -> political neurology and the
next thing you know a drone is flyign overhead and the emg-test you
last had forces a twitch in your arm via EM reflex and you drive off
the cliff. do not need to wait for automated cars to steer you off the
road, it can already happen today, if such systems are 'weaponized'.

what is to prevent such dynamics from existing if they are not
accounted for. and thus this is only one aspect, the danger of not
knowing, yet what may be realized if such a model of the
electromagnetic human was understood or part of the conceptualization
of shared relations, part of the intellectual framework that mediates
the world in a sea of toxic signalling, and what is the limit or
boundary for this happening, (the entire education system for
starters)

so a non EM-worldview and non-EM humans existing in electromagnetic
civilization as shared context yet believing the self 'outside' this
perspective for analysis and evaluation, having rationalized and
accounted for activity only in non-EM terms and conceptualization.
sounds like the wrong mathematics of zero again. what is the structure
of the human nervous system, how does this digital and-or analog
circuitry relate to issues of infrastructure, wireless communication,
potential frameworks for consciousness, embodiment, being.

(note: in exploring basic electronics, the category of sensors
fascinated me, especially in regard to common features they share,
such as strain, and their often ~analog nature, as well as a principle
of reversibility in functioning, as if of a deeper symbiotic
connection involved)

(what then does it mean for an all-digital computer in terms of
'processing' or reasoning, versus a hybrid system that matches
functionality of nervous system in its dynamic range)

How brains go from digital to analogue
http://freshscience.org.au/2008/how-brains-go-from-digital-to-analogue

[quote] “We not only saw that nerve impulses are able to send out
signals in an analogue manner, but we also found this could be
perceived by neighbouring nerve cells if located close enough.” The
more closely cells are connected to each other, the more information
can be received from the analogue signal. [unquote]

// mixed analog-digital nature of communication (ref. 3/645)

Brain Communicates in Analog and Digital Modes Simultaneously
http://news.yale.edu/2006/04/12/brain-communicates-analog-and-digital-modes-simultaneously

[quote] “It’s as if everyone thought communication in the brain was
like a telegraph, but actually it turned out to be more similar to a
telephone,” he said. [unquote]

(note: digital as on/off switch and analog as grey-area switch or gauge)

[video]  IS LIFE ANALOG OR DIGITAL? -- FREEMAN DYSON
http://edge.org/conversation/is-life-analog-or-digital

note: ANALOG IS MORE POWERFUL THAN DIGITAL

(is information that exists outside a computer analog/digital, is a
non-virtual material_artifact and thus matter_itself analog/digital?
is energy analog and-or digital. in what domain is culture occurring
as consciousness, as communication. ideas. where is crypto, only
digital???)

[excerpt]  II. Philosophers' Distinctions - II.1 Von Neumann
http://www.ellieepp.com/theory/analog/analog5.html

       "The nervous system is based on two types of communications:
those which do not involve arithmetical formalisms, and those which
do, i.e. communications of orders (logical ones) and communications of
numbers (arithmetical ones). The former may be described as language
proper, the latter as mathematics. (von Neumann, 1958, 80)"

Von Neumann's The Computer and the Brain, written in 1956 and
published in 1958, made the analog/digital distinction relevant to
philosophy by claiming that the logics and mathematics of the central
nervous system, viewed as representational systems, must "structurally
be essentially different from those languages to which our common
experience refers" (1958, 82). He has in mind here both natural
language and binary mathematics. [...]


== sidenote B ==

as with crypto basics and possibilities, it is my belief that the
basic breadboard circuit in its actual dynamics has not been fully
accounted for, in that the relation of charge (+/-) including neutral
or  'ground' is not adequately modeled in accurate terms of existence
and instead a structural skew exists that sends everything into a
particular direction. also with crypto that becomes about mathematic
equations and 'beliefs' about signage, than of other dynamics that
exist in the same realm yet whose dimensions may be unrecognized,
ignored, or without value in a given methodology or approach, while
inherently relevant to the core ideas and cryptologic processes. i do
not think or believe the basic circuit has been figured out, that it
remains a question. that the analog digital aspects of the circuit may
be wrongly modeled or conceptualized in the actual terms they exist -
because LOGIC. because of a binary (and yes, thus 'digital' ideology)
approach that favors a certain rationalization as if universal
reasoning when it breaks down at a given threshold or boundary yet
continues on as a 'belief system' in certain assumptions and views
that can be inaccurate or illusory, if not deceptive, false. when the
dynamics between a basic circuit and model of the atom and thus
molecules in which the identical charge relations exist and provide
momentum -do not align or match up- in terms of how they are conceived
and what is going on with grounding (mathematics of zero), such that
"infinity" is made or modeled as if finite, removed from dynamics,
then the potential that is in the realm of N-value is also removed,
made 'digital' as it were even with analog modeling. and it would seem
so too crypto, 'quantum' processing itself seemingly more analog in
the range of parallelism as basis for computation, as a natural
process of equilibrium even, perhaps. and how much of the multi- or
non-linearity of circuitry, its ecological or ecosystem based ~complex
dynamics similar exist in this as a foundational, fundamental context,
firstly, before the digital even develops as a simple on/off switch,
then to represent and model _everything in that reductionist
framework, and claim its signage to represent all that is.

(without accurate logical accounting can such modeling be accurate in
its grounded truth, if this truth is unrecognized or unreferenced
beyond binary biasing and distortion (digital worldview?). how much of
observation is contained or trapped within its warping(etc);)

maybe thinking is not up-to-speed with material interactions, a gap
between models and reality, yet beliefs in accurate representations
that are limiting, based on misconceptions. thus, remove logic
(empirical and error-corrected grounded reasoning) and
electromagnetism, and try conceptualizing computers and crypto in that
context and see what happens. this.

computers are based on _logic, yet a particular kind that is warped
and ideological and is in error as a neutral observational viewpoint.
developing this bias as technological worldview is then enshrining a
false empiricism and vault of the 'digital sky' as consciousness when
it acts and functions against actual consciousness in its ungrounded,
unchecked state, as if 'being' itself. exploitation of this condition
(a kind of magic, sorcercy) tending towards evil as it moves further
and further away from truth and serves and extends the false approach,
what is essentially a shared lie if facts and truth are ignored,
censored, etc. total power, control over a developing system that at
its core is based on error. here, morality, ethics, absence of law
that upholds the false framework as it is institutionalized,
"believed" via leap of faith, ignoring the gap, denying the gap, for
all the material rewards it can yield to its developers. unchecked of
course, forbid from error correction. the representation replacing
reality. the sign becoming truth, that detachment, ungrounded
condition. just like circuit & adam.

(also: quantum computer of people, shared consciousness in parallel
empirical evaluation)


== random ==

1. if prohibition of alcohol = control of speech, as a side-effect,
via behavioral influence, that is, sobriety; what is prohibition of
crypto? control of controversial thoughts and connections, an indirect
form of secondary censorship. Fahrenheit 451 tactics- actual crypto
the fire.

2. if everything is backdoored already, essentially key escrow exists
as the basic situation, instead of having private keys the NSA has a
master key per standard, implementation, other. if this was inside a
known legal framework, that perhaps would be tolerable with oversight,
yet without oversight where tyranny takes over, then everything is
pawned/owned by NSA who could forcibly censor without consequence as
part of a hidden political strategy, etc.
(all tools broken so a crypto scheme can function, leading to all
tools remotely breakable?)

3. question of literature as applied cryptography in
linguistic/typographic model, and also cryptology in decryption
approaches to embedded codes and ciphers, yet perhaps not a strategy
for encryption within ordinary bounded means and measures. are there
in this way two or more distinct approaches, only one that finds
itself in the parameters of computer encryption/decryption as modeled,
and the others reside in a realm of data mining and other statistical
correlations that may function in a realm of cryptanalysis and-or
code-breaking though using different tools and approaches than strong
encryption that currently reigns.

4. is there a unified crypto scheme or is it fragmented and does not
recognize itself in the mirror as its own 'whole' self due to a limit
for this structural-conceptual integration. in this way could
cryptography be schizoid in having two or more parallel systems,
disconnected strategies that function outside boundaries of the other,
and may remain unrecognized. that is, literature/language/linguistics
as crypto versus mathematic encrypt/decrypt schemes, each having their
own ecosystems and boundaries, paths that may never cross or meet
within the given parameters or dimensions as evaluated by the other,
or may exist as unbroken ciphers within other ciphers, encrypted code
within decrypted communications that remains unrecognized due to this
unrelated, ungrounded condition between them.

5. in this way could having 'answers' at the ready (GOTO 2) then
provide confirmational bias that a correct decrypt has been achieved
within a limited view that then becomes foundation for a false
perspective, represented by mathematics. and may a particular
rationalization (GOTO 1) that is enforced as if objectivity defined,
then become the basis for an illusion of mastery or control over
limited dimensionality and observational frameworks, themselves
becoming the basis for an insecure crypto framework (see 1). in other
words, without or banning abberations, then leading to a false
condition of certainty by containing what is or may be uncontainable,
making finite the infinite question and potential parameters into a
'small world'(model); ineffective at best in accounting for actual
crypto, operating.

6. does a hybrid crypto approach exist that remains unrecognized,
whereby both a linguistic even 'literature-based' crypto could exist
alongside mathematical encryption techniques yet remain unrecognized
in the "official" institutional model of cryptography, perhaps even
with a missing cryptological foundation or background, that limits a
realm of computer crypto to a narrow investigation of algorithms and
security inside a bounded, finite domain? (see 3/645)


[image]  A 47-Year-Old Prediction Comes True //  via hh
http://www.linkedin.com/today/post/article/20131213160729-4444200-a-47-year-old-prediction-comes-true?trk=tod-home-art-list-large_0


Keeping the lights on: Mechanical engineer
finds a way to predict cascading power outages
http://phys.org/news/2013-12-mechanical-cascading-power-outages.html

"Each individual component does not know what the collective state of
affairs is," said Mezic. Current methods rely on a steady, abundant
supply, producing enough energy to flow through the grid at all times,
regardless of demand, he explained. However, should part of a grid
already operating at capacity fail—say in times of disaster, attack or
malfunction—widespread blackouts all over the system can occur.

"Everybody shuts down," Mezic said. The big surges of power left
unregulated by the malfunctioning component can either overload and
burn out other parts of the grid, or cause them to shut down to avoid
damage, he explained. The result is a massive power outage and
subsequent economic and physical damage. The Northeast Blackout of
2003 was one such event, affecting several U.S. states and part of
Canada, crippling transportation, communication and industry.
[unquote]


{educational fair-use of copyright, 2013}

1/-12  -12/18   9/2




From juan.g71 at gmail.com  Sat Dec 14 10:20:45 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sat, 14 Dec 2013 15:20:45 -0300
Subject: Joke
In-Reply-To: <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
Message-ID: <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>



--On Friday, December 13, 2013 7:31 PM -0800 Tom Ritter <tom at ritter.vg>
wrote:

> I doubt it - abuse through Tor is a legitimate problem.  


	Not sure what that means. At any rate, there seems to be something wrong
with the bitcoin forum blocking anonymous(sort-of) access, no?

	
 


> Wikipedia blocks
> editing from Tor for the same reason.


	ah, wikipedia....


> 
> There are ideas for solving this though, and it would be cool to see more
> ideas, and more fleshing out of them.  Mike Hearn has talked about having
> people make a bitcoin deposit for an account, and after so much time of
> legitimate use, the deposit is refunded. 


	Legitimate use? Such as? Parroting whatever garbge the 'wikipedia editors'
say it must be parroted? 


> Before that, if it's used for
> abuse, the deposit is kept by the service.

	That's cool. So, say something those idiots don't like, and they 'keep'
(steal) your money. 




> 
> -tom
>  





From grarpamp at gmail.com  Sat Dec 14 12:23:38 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sat, 14 Dec 2013 15:23:38 -0500
Subject: Services Blocking Tor [was: Joke]
Message-ID: <CAD2Ti29gmMH7U8H+9J8nVN5TpnFSnSCkw8UL9sOndufDDS1z1A@mail.gmail.com>

On Sat, Dec 14, 2013 at 1:20 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
> --On Friday, December 13, 2013 7:31 PM -0800 Tom Ritter <tom at ritter.vg>
> So, I tried to create an account at bitcointalk.org and got this
>        "Due to abuse, registration through Tor is not permitted. "
>       That's got to be a joke, right? right?

In the context that Bitcoin needs an anonymizing layer to be anonymous,
yes, it's rather silly.

>> I doubt it - abuse through Tor is a legitimate problem.

Abuse through the plain old internet is likely far more of a problem
regarding volume of tickets generated.

>         Not sure what that means. At any rate, there seems to be something wrong
> with the bitcoin forum blocking anonymous(sort-of) access, no?

There is this
https://trac.torproject.org/projects/tor/wiki/org/projects/DontBlockMe

>> There are ideas for solving this though, and it would be cool to see more
>> ideas, and more fleshing out of them.  Mike Hearn has talked about having
>> people make a bitcoin deposit for an account, and after so much time of
>> legitimate use, the deposit is refunded.

>> Before that, if it's used for
>> abuse, the deposit is kept by the service.
>
>         That's cool. So, say something those idiots don't like, and they 'keep'
> (steal) your money.

That's why you should only use services that send such
deposit defaults to established third party 'charities' you preselect
when creating your account. The Bitcoin blockchain could be
used to prove your default was sent to such third party by posting
the txid to your account that you are now otherwise locked from
using (at least until some future deposit/appeal is made). A service
provider that has this charity policy, cancels an account, and then
chooses to steal the money for themselves would quickly develop
a painfully public reputation issue.

Some say service providers really shouldn't cancel accounts except as
matter of Law, not their own policy whim, but that's another issue altogether.




From tom at ritter.vg  Sat Dec 14 12:23:50 2013
From: tom at ritter.vg (Tom Ritter)
Date: Sat, 14 Dec 2013 15:23:50 -0500
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>
References: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
 <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>
Message-ID: <CA+cU71mMhSKA+DJW5DBWyJvBbGk1LLJGCBjK4BPwgvGvRs-sog@mail.gmail.com>

On 14 December 2013 14:51, Peter Gutmann <pgut001 at cs.auckland.ac.nz> wrote:

> For example if you
>  follow DSA's:
>
>   k = G(t,KKEY) mod q
>
> then you've leaked your x after a series of signatures, so you need to know
> that you generate a large-than-required value before reducing mod q.  The
> whole DLP family is just incredibly brittle, a problem that RSA doesn't
> have.
>


This is different from the normal 'repeated/non-random k leads to private
key', is it not?  Is there a paper/reference I can read more about this
attack?

-tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1060 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/1a84865c/attachment.txt>

From electromagnetize at gmail.com  Sat Dec 14 15:02:01 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 14 Dec 2013 17:02:01 -0600
Subject: c4-r3kN.txt (urls)
In-Reply-To: <CAJVRA1Qf+QqiigmLnrK3mL7mS06xUf+G8_Ycw_ceZmKhXZb=WA@mail.gmail.com>
References: <CADhsnxdU3mJGuCTr+jyJmjnfEQ7avyCHTnd2fNLAGg9W3TNe2Q@mail.gmail.com>
 <CAJVRA1Qf+QqiigmLnrK3mL7mS06xUf+G8_Ycw_ceZmKhXZb=WA@mail.gmail.com>
Message-ID: <CADhsnxd5xhFthAWaOS1nxnzdUVxxVHLGdfzN-MMn8R_vrZckFA@mail.gmail.com>

== random ==

>> 1. if prohibition of alcohol = control of speech, as a side-effect,
>> via behavioral influence, that is, sobriety;

 coderman <coderman at gmail.com> wrote:

> i never considered prohibition as constraint on state of mind in public,
> mainly thinking along monetary and covert economic activity angles.
>
> but considering the public, and the multitudes of social scenes no
> longer "lubricated" or under shadow of persecution, this would have a
> direct and personal impact on many.
>
> certainly a world removed from the producers and distribution
> activity, which tends to monopolize the zeitgeist of the prohibition
> era.

this observation arose from a recent conversation about influence
of alcohol on behavior and mood. where someone who drinks can
say things that they otherwise may not, and in this way a given
viewpoint may have a deeper grounding in the emotions that are
not being accounted for, and could be realized or accessed when
decompressing or reaching equilibrium in another phase or state
of awareness, via inebriation. the role of legal & illegal substances
in relation to edge of insight and cultural development likewise.

thus the aberrant statement or communication that may occur
via this communication is not necessarily less truth, only that
it may not be acknowledged or accounted for in the given view
or modeling. thus, a kind of equilibrium or balancing of forces,
or equalization across parameters known and unknown, those
documented and hidden, via inebriation. for instance, anger if
it arises when drinking and hidden rage. or following ideology
and then when inebriated a person letting down their guard &
speaking their mind, etc. in this way, truth and ideas that may
not fit in the given model. and how this could be an influence
upon culture and conformity if removed and this unwitting or
known feedback does not occur, and a rigid view is upheld
as the cultural standard, instead. where this balancing of
forces may not take place due to its prohibition, even, as
this could advantage those managing skewed modeling
and using it to enforce a given approach, and limit any
alternatives because it does not fit inside the mindset
or belief system, and cannot be questioned beyond this.

in this way, sobriety is equated with a higher knowing or
state of being, potentially, seeing more clearly, when if
in its position it is bounded or limited, these areas of
previous feedback would essentially be outlawed and
not addressed, or set up a schizoid state of relation
by denying other dimensions or relations or dynamics,
as if everything is contained with a rationalization even,
versus breaking-through that boundary into chaos and-
or the unknown, or challenging beliefs about what truth
is and where control originates in the cosmic context.
in that there is a limit to what can be determined via
reductionism, though no limit to the belief of this,
which can stand uncorrected, opposed to truth and
greater evidence than what is allowed or sanctioned.

leading to this...

>> what is prohibition of
>> crypto? control of controversial thoughts and connections, an indirect
>> form of secondary censorship. Fahrenheit 451 tactics- actual crypto
>> the fire.

i understand the different interpretation, and did not
adequately define the analogy, well enough to be make
the correlation clear enough. in the book by Ray Bradbury
it is the truth and ideas in the medium of the book that are
at issue, not just books but their use as a transmission of
beliefs, of alternative (non-sober) principles that challenge
the ruling order that seeks to extinguish this otherness
that is essentially culture itself, knowledge, reality. that
is the basis for control over people and the civilization.

what this extends into further in a cryptography context
is that 'crypto' itself may be outlawed like books, not for
technical means to communicate, but because what is
communicated could be _secret and not controllable by
those who seek total control over what occurs in society.

thus truth, another viewpoint shared by people, especially
if counter to corrupt government, could be this fire held in
the container of crypto, and if it is broken by default and-or
corrupted by design, this other viewpoint could never develop
beyond a given set of parameters because those who think
differently are seen as and believed to be 'the enemy' within
a state that has become rogue and functions against its
own people, in order to forever secure its power over them.

in other words: ideas, truth, shared reasoning is the danger,
and if it cannot be safely exchanged without consequence,
losing your job or career or having ideas disallowed and thus
trading in bad thoughts, as if drunken ramblings even, then
through this prohibition of ideas and thinking, as it relates
to grand inquisitor like auditing of any private domains and
whatever "secrets" people may be sharing, then could be
equivalent to peering into the war plans of the enemy and
all of this could be mapped out into a strategy that seeks
to eliminate this risk of unknowns, to uphold empowered
and extending rationalization within a particular system
of belief that aligns with private politics and corruption,
state of hidden dictatorship, and engineering failure so
to sustain the corrupt works as enterprise planning.

in other words, no crypto, no protected boundary for
freedom of expression or freedom of thought/speech,
communication, or practice of religion even, without
hidden judge, jury, potentially executioner via NSA
and others who are like the monster under the bed,
though inside computers, minds, communications.
where did they get the right to enforce and defend
mediocrity, to pursue and extinguish truth that does
not fit into or is opposed to the ruling political ideology,
and to not have any oversight and be given carte blanche
to pursue a political agenda against citizens, a lawless
agenda that is actively oppressing people in civilization,
and seeks to uphold and enforce an unreal, antihuman
viewpoint that is based on subjugation and exploitation.

i mean if the NSA was going around abusing children
and connected with pedophile networks and seeking
to blacklist and exploit people based on porn habits
or enforcing a no-masturbation rule by "government",
that would be a pretty important insider story, no?

those are the politics also involved in these questions,
the kind of substitute culture that can at once uphold
an unrealistic worldview only to use this for exploitation.
that is what happens in situations of corruption, and in
situations of total corruption, it is institutionalized and
made mainstream yet cannot be communicated about.
so if the crypto is non-existent, so too is such reality.

anyone who starts to think can be persecuted by the
criminals and taken down in isolation, and framed as
if just another sinner via the inside-subversion. that is
how books with another viewpoint can offer perspective
otherwise outlawed, so too working cryptography that
cannot be decrypted. without it, shooting fish in a barrel.

i vote those who work at NSA should be made to wear
helmets and uniforms, and wear big 'key' medallions
around their necks, so we know we are totally owned.
(not sure which way the rubber hose prop should go,
if firehose or perhaps each wearing condom bandoleer)

NSA is watching you masturbate!

(the new WPA posters for the sterilized asexual set)




From jbrechtel at gmail.com  Sat Dec 14 14:21:06 2013
From: jbrechtel at gmail.com (James Brechtel)
Date: Sat, 14 Dec 2013 17:21:06 -0500
Subject: Joke
In-Reply-To: <AA0A1C62710ED73F53DBF6F1@F74D39FA044AA309EAEA14B9>
References: <AA0A1C62710ED73F53DBF6F1@F74D39FA044AA309EAEA14B9>
Message-ID: <CAMHEHBTFRanu7WafP1VEEJ0jOiTQm1F_78B8=frB2kj=biihJQ@mail.gmail.com>

>   That's cool. So, say something those idiots don't like, and they 'keep'
(steal) your money.

One of the neat things about BitCoin is it can enable the upsides of this
kind of pay-to-play transaction without the downside (e.g. they keep/steal
your money).

Essentially you can agree to put the money in an escrow, effectively, for
some amount of time and if you both decide so then it can be released to
you early....but they can never get it themselves.

https://en.bitcoin.it/wiki/Contracts#Example_1:_Providing_a_deposit


On Sat, Dec 14, 2013 at 4:35 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:

>
>
> --On Saturday, December 14, 2013 1:30 PM -0800 Al Billings
> <albill at openbuddha.com> wrote:
>
> > From: Juan Garofalo Juan Garofalo
> >
> >> Do you ever have anything positive or nice to say, Juan?
> >
> >
> > Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you
> > think I should be licking?
> >
> > Any that make you grow up into a human being that isn't an asshole?
>
>
> >       Well, care you about giving an example, you stupid sack of shit?
>
>
>         Oops, Sorry (I fear I upset poor Al again), that should have been
>
>
>         "Well, care about giving an example, you stupid sack of shit? "
>
>
>         Now, that's better.
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> >
> > --
> > Al Billings
> > http://makehacklearn.org
> >
> >
>
>
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2312 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131214/fbfd2ae8/attachment.txt>

From juan.g71 at gmail.com  Sat Dec 14 13:22:14 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sat, 14 Dec 2013 18:22:14 -0300
Subject: Joke
In-Reply-To: <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
 <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
 <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>
Message-ID: <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>



--On Saturday, December 14, 2013 12:26 PM -0800 Al Jigong Billings
<albill at openbuddha.com> wrote:

> Do you ever have anything positive or nice to say, Juan?


	Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you
think I should be licking? 

	


> 
> On Saturday, December 14, 2013, Juan Garofalo wrote:
> 
>> 
>> 
>> --On Friday, December 13, 2013 7:31 PM -0800 Tom Ritter
>> <tom at ritter.vg<javascript:;>
>> > 
>> wrote:
>> 
>> > I doubt it - abuse through Tor is a legitimate problem.
>> 
>> 
>>         Not sure what that means. At any rate, there seems to be
>>         something wrong
>> with the bitcoin forum blocking anonymous(sort-of) access, no?
>> 
>> 
>> 
>> 
>> 
>> > Wikipedia blocks
>> > editing from Tor for the same reason.
>> 
>> 
>>         ah, wikipedia....
>> 
>> 
>> > 
>> > There are ideas for solving this though, and it would be cool to see
>> > more ideas, and more fleshing out of them.  Mike Hearn has talked
>> > about having people make a bitcoin deposit for an account, and after
>> > so much time of legitimate use, the deposit is refunded.
>> 
>> 
>>         Legitimate use? Such as? Parroting whatever garbge the 'wikipedia
>> editors'
>> say it must be parroted?
>> 
>> 
>> > Before that, if it's used for
>> > abuse, the deposit is kept by the service.
>> 
>>         That's cool. So, say something those idiots don't like, and they
>> 'keep'
>> (steal) your money.
>> 
>> 
>> 
>> 
>> > 
>> > -tom
>> > 
>> 
>> 
>> 
>  





From juan.g71 at gmail.com  Sat Dec 14 13:32:49 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sat, 14 Dec 2013 18:32:49 -0300
Subject: Joke
In-Reply-To: <etPan.52accddd.579478fe.1da5@Al-Retina.local>
References: <FFAC2156C06CBA5F361ABE59@F74D39FA044AA309EAEA14B9>
 <CA+cU71nOsK8kAd5j3ubcsKFtBJBVk8MustN8dA53RMFJ9zuDHA@mail.gmail.com>
 <CC45E94F05411E48C46FFA03@F74D39FA044AA309EAEA14B9>
 <CAMY+0ULH1w=6ubuAv-xMc3H5wzjuZ7=979XDNrUQV5_P2QqBsQ@mail.gmail.com>
 <655A77CE7E15F50472D148AB@F74D39FA044AA309EAEA14B9>
 <etPan.52accddd.579478fe.1da5@Al-Retina.local>
Message-ID: <CE3EB00E7176B4054DDF2E8F@F74D39FA044AA309EAEA14B9>



--On Saturday, December 14, 2013 1:30 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> From: Juan Garofalo Juan Garofalo
> 
>> Do you ever have anything positive or nice to say, Juan? 
> 
> 
> Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you 
> think I should be licking? 
> 
> Any that make you grow up into a human being that isn't an asshole?


	Well, care you about giving an example, you stupid sack of shit? 





> 
> -- 
> Al Billings
> http://makehacklearn.org
> 
>  






From juan.g71 at gmail.com  Sat Dec 14 13:35:33 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sat, 14 Dec 2013 18:35:33 -0300
Subject: Joke
Message-ID: <AA0A1C62710ED73F53DBF6F1@F74D39FA044AA309EAEA14B9>



--On Saturday, December 14, 2013 1:30 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> From: Juan Garofalo Juan Garofalo
> 
>> Do you ever have anything positive or nice to say, Juan? 
> 
> 
> Oh, I'm pretty sorry I upset you, Al. Tell me, please, Whose boots you 
> think I should be licking? 
> 
> Any that make you grow up into a human being that isn't an asshole?


>	Well, care you about giving an example, you stupid sack of shit? 


	Oops, Sorry (I fear I upset poor Al again), that should have been 


	"Well, care about giving an example, you stupid sack of shit? "


	Now, that's better.








	










> 
> -- 
> Al Billings
> http://makehacklearn.org
> 
>  

 




From griffin at cryptolab.net  Sat Dec 14 16:41:52 2013
From: griffin at cryptolab.net (griffin at cryptolab.net)
Date: Sat, 14 Dec 2013 19:41:52 -0500
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed
 by Stewart Baker
In-Reply-To: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
References: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
Message-ID: <c4f74c19208fb121c56926a7ead684d7@cryptolab.net>

Il 14.12.2013 13:36 coderman ha scritto:
> this is pretty amusing :P
> 
> (and needs a "Knuth is my Homeboy" homage?)

   The title that spawned a dozen fanfics. ;P

   It's pretty excellent that they're both able to have a sense of humour 
about the situation.  And, maybe someone will bring in the magic of 
Photoshop and turn this into a t-shirt :D

~Griffin




From bill.stewart at pobox.com  Sat Dec 14 23:27:24 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Sat, 14 Dec 2013 23:27:24 -0800
Subject: Gmail's receiving mostly authenticated email
In-Reply-To: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
References: <20131214213326.56CD5F435@a-pb-sasl-quonix.pobox.com>
 <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
Message-ID: <20131215072753.83620EA38@a-pb-sasl-quonix.pobox.com>

At 09:56 PM 12/14/2013, Peter Gutmann wrote:
>Bill Stewart <bill.stewart at pobox.com> writes:
>
> >Saw an interesting article from Gmail on their inbound email 
> statistics. Over
> >91% is authenticated with either DKIM or SPF.
>
>What percentage of that is using 512-bit keys?

They didn't say.  (And the threat model for spam protection probably 
doesn't include spammers cracking RSA keys, so 512-bit would be 
perfectly adequate, but I'd hope people were using 1024.)




From l at odewijk.nl  Sat Dec 14 19:32:32 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Sun, 15 Dec 2013 04:32:32 +0100
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed by
 Stewart Baker
In-Reply-To: <c4f74c19208fb121c56926a7ead684d7@cryptolab.net>
References: <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
 <c4f74c19208fb121c56926a7ead684d7@cryptolab.net>
Message-ID: <CAHWD2rJG8Sh5MDwmV2CRbF80AEhYzNix29hsnax3XsBF-4G_3w@mail.gmail.com>

*insert applebaum NSA connection paranoia*

It's pretty common for opposing parties to have respect for one another. To
joke, too, isn't peculiar. They aren't bad people, they simply have
different approaches. Disagree yet strive for admirable goals all the same.

They do also enable eachother's existence. Without the fight for privacy we
wouldn't need the warriors.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 571 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131215/0156864f/attachment.txt>

From grarpamp at gmail.com  Sun Dec 15 03:09:21 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sun, 15 Dec 2013 06:09:21 -0500
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
Message-ID: <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>

> Phillip H-B, et al have been saying...
> [email encryption, etc]
> What is the gap we have to close to turn this on by default?

How many times has this been rehashed the last six months?
You can't fix email as we know it today using todays bolt-ons,
protocols and corporate stakeholders/services trying to profit from it.
The only way to have any real global seamless success is to go
ground up with a completely new model. IMO, that will be some
form of p2p message system where every address is a crypto key,
masked for grandma by her contact list, decrypted out your p2p
daemon and piped into your local mail processing (MUA/filter/lists)
and filesystem (encryption). At least that way your local mail tools
will still work (no one will give those up anyway).

The problem is the antique centralized backend, it needs bypassed.
You've got neat stuff like Tor, bittorrent, bitcoin, etc already... so
boost email into the 2020's the same way. Then let the old world
email services try to keep up, and slowly die like everything else.




From pgut001 at cs.auckland.ac.nz  Sat Dec 14 11:51:07 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Sun, 15 Dec 2013 08:51:07 +1300
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
Message-ID: <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>

Tom Ritter <tom at ritter.vg> writes:

>ECC has other attributes that make it attractive too, so let's get the
>plumbing ready, so we can support a quick pivot away from RSA and over to ECC
>if we have to.

ECC however has the downside that it's incredibly brittle.  For example
there's the scary tendency of DLP-based ops to leak the private key (or at
least key bits) if you get even the tiniest thing wrong.  For example if you
follow DSA's:

  k = G(t,KKEY) mod q

then you've leaked your x after a series of signatures, so you need to know 
that you generate a large-than-required value before reducing mod q.  The 
whole DLP family is just incredibly brittle, a problem that RSA doesn't have. 
I'm much more comfortable with RSA, there's far fewer things that can go 
wrong.

Peter.




From felix at tribut.de  Sun Dec 15 02:48:43 2013
From: felix at tribut.de (Felix Eckhofer)
Date: Sun, 15 Dec 2013 11:48:43 +0100
Subject: Gmail's receiving mostly authenticated email
In-Reply-To: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
References: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
Message-ID: <63ac0a283b6600d532338d08d496e8a7@tribut.de>

Am 15.12.2013 06:56, schrieb Peter Gutmann:
> Bill Stewart <bill.stewart at pobox.com> writes:
> 
>> Saw an interesting article from Gmail on their inbound email 
>> statistics. Over
>> 91% is authenticated with either DKIM or SPF.
> 
> What percentage of that is using 512-bit keys?

According to [1], Google is treating mails signed with keys <1024bit 
keys as unsigned.


felix

[1] https://support.google.com/mail/answer/180707?hl=en




From tom at ritter.vg  Sun Dec 15 11:23:09 2013
From: tom at ritter.vg (Tom Ritter)
Date: Sun, 15 Dec 2013 14:23:09 -0500
Subject: Gmail's receiving mostly authenticated email
In-Reply-To: <20131214213326.56CD5F435@a-pb-sasl-quonix.pobox.com>
References: <20131214213326.56CD5F435@a-pb-sasl-quonix.pobox.com>
Message-ID: <CA+cU71kig=d8WokhkFVa0bztNh1yPCs7AW-vBvXumTKVurJKWw@mail.gmail.com>

I saw that article too, and thought it was interesting, but I noticed
something odd in their statistics:

"""
91.4% of ***NON-SPAM*** emails sent to Gmail users come from
authenticated senders, which helps Gmail filter billions of
impersonating email messages a year from entering our users’ inboxes.

More specifically, the 91.4% of the authenticated ***NON-SPAM***
emails sent to Gmail users come from senders that have adopted one or
more of the following email authentication standards: DKIM (DomainKey
Identified Email) or SPF (Sender Policy Framework).
""" (emphasis mine)
http://googleonlinesecurity.blogspot.com/2013/12/internet-wide-efforts-to-fight-email.html

So first Google runs their pretty-good-but-not-perfect spam filtering,
then they look at what they're categorized as non-spam to generate
those statistics.  The ham (not spam) emails that are miscategorized
are much more likely to be omitting SPF/DKIM, so there's a bit of
selection bias occurring.

Also, for what it's worth, SPF isn't related to crypto at all, and is
ridiculously easy to set up for 'normal' domain admins.  (That is,
domain admins with a couple well-known SMTP servers, and not some
crazy distributed architecture.)  There's a great calculator online
for it here: https://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/default.aspx
There's some tricky questions people may not know the answer to, but
omitting answers will only create a more _permissive_ policy, rather
than run the risk of borking your email.

-tom




From grarpamp at gmail.com  Sun Dec 15 13:54:08 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sun, 15 Dec 2013 16:54:08 -0500
Subject: Gaps in email [was: PGP userbase]
Message-ID: <CAD2Ti2-3OHPFJjRpD6Ecf7-g3q7KY9q19eJARD0neYP06h268A@mail.gmail.com>

>> Phillip H-B, et al have been saying...
>> [email encryption, etc]
>> What is the gap we have to close to turn this on by default?
>
> How many times has this been rehashed the last six months?
> You can't fix email as we know it today using todays bolt-ons,
> protocols and corporate stakeholders/services trying to profit from it.
> The only way to have any real global seamless success is to go
> ground up with a completely new model. IMO, that will be some
> form of p2p message system where every address is a crypto key,
> masked for grandma by her contact list, decrypted out your p2p
> daemon and piped into your local mail processing (MUA/filter/lists)
> and filesystem (encryption). At least that way your local mail tools
> will still work (no one will give those up anyway).
>
> The problem is the antique centralized backend, it needs bypassed.
> You've got neat stuff like Tor, bittorrent, bitcoin, etc already... so
> boost email into the 2020's the same way. Then let the old world
> email services try to keep up, and slowly die like everything else.


/ There are people I know who do not mind the extra steps for pgp. I
/ certainly want to get the roll out to use and test and enjoy. Sign me
/ up.


Encryption is only part of it. There's transport, elimination of
central storage, anonymity, p2p, etc. Many things people want
simply can't be done with modifications to the current system.
With p2p model and every node as a key/address, you don't
need 'pgp' because the node is the key and does lookups and
encrypt2dest / decrypt2you for you. But you can still use pgp with
the usual tools around message bodies if desired for additional
encrypt/auth or if you're disk isn't encrypted. P2P daemon
takes over and all the old transport headers go away.
Spam/AV becomes another local daemon. Mailing lists are
a repeater node someone runs, or the usual local mailman stuff.
It's a transport replacement, so business can use it account at node.
All the MTA's die off in time.

[Please direct list replies to the list, not me. I should have broke
the subject earlier.]




From coderman at gmail.com  Sun Dec 15 18:11:20 2013
From: coderman at gmail.com (coderman)
Date: Sun, 15 Dec 2013 18:11:20 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
Message-ID: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>

Video:
 https://archive.org/details/schneier
Audio:
 http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_schneier/

"Join us at Columbia Law School as renowned security expert Bruce
Schneier talks with Eben Moglen about what we can learn from the
Snowden documents, the NSA's efforts to weaken global cryptography,
and how we can keep our own free software tools from being subverted."




From grarpamp at gmail.com  Sun Dec 15 15:20:03 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sun, 15 Dec 2013 18:20:03 -0500
Subject: The next generation secure email solution
In-Reply-To: <alpine.LFD.2.02.1312152112430.4974@laptop.kerry-linux.ie>
References: <alpine.LFD.2.02.1312152112430.4974@laptop.kerry-linux.ie>
Message-ID: <CAD2Ti28NKDFfbW3XwsCZRMwYf6hwhfCG48u9O4Epm53=_5vrww@mail.gmail.com>

Moving the last couple days talk to this thread seems fine.

On Sun, Dec 15, 2013 at 3:19 PM, Ralf Senderek <crypto at senderek.ie> wrote:
> On Sun, 15 Dec 2013 grarpamp wrote:
>
>> The only way to have any real global seamless success is to go
>> ground up with a completely new model. IMO, that will be some
>> form of p2p message system where every address is a crypto key,
>> masked for grandma by her contact list, decrypted out your p2p
>> daemon and piped into your local mail processing (MUA/filter/lists)
>> and filesystem (encryption). At least that way your local mail tools
>> will still work (no one will give those up anyway).
>
>
> If you are so sure, can you tell us how the next generation secure email
> solution will solve the "trust problem", please.

Though unclear, that sounds like the old trust of a CA/PKI system problem.

> How does the p2p daemon
> find the correct crypto key, so that every user can rely on its invisible
> performance?

In general I suggest that people wish to use messaging with each other
once they already know them (or have some other trusted web to them).
As in, Hey John, nice to meet ya today, what's your key (address), I'll
message you later. Or Hey Jane, what's John's address. Same for
employers, businesses, etc. Such peer groups bootstrap and grow
very fast. Thus the perceived need for a cold lookup of Ralf, isn't much of
a real one.
Once you know the address (node crypto key), you put it 'To: <key>',
mua hands to spool, p2p daemon reads spool, looks up key in DHT and
sends msg off across the transport to the far key (node) when it is
reachable. Hopefully the transport looks like I2P/Tor in being a secure
random hop layer. In fact, those could probably be used today, they
have the keys as nodes and user facing ports for inbound/outbound
daemons. They just need scaling work to n-billion nodes (users,
aka: the hard part). People are already plugging postfix, bittorrent,
etc into these networks.

Tor is not currently addressible at the user level by the full key,
it 'shortens' the key into a 16char onion address. As you may be
hinting at... yes, that is bad... collisions, and needing secondary lookup
layers into the full key. Tor may be moving to full key addressibility
soon, see tor-dev for that.

I2P (and Phantom, and probably GnuNet) are addressible with full keys.
So you can send to 'account at key' with them if you want, and keep the
John/Jane/Ralf human style lookups in your MUA addressbook (once
you know them) without needing a secondary lookup layer into the full key.

No, I am not sure. But when looking at some of the p2p transport
layers that have come along so far, it seems like a fairly strong
possibility for a new backend transport model while retaining user
level mail tools... mutt, maildrop, mailman, Thunderbird, etc. Most
of what you'd need there is support for very long addresses and
split horizon handoff to local daemon/spool based on recognizing
what the destination net is... .onion, .i2p, etc.
I'd like to read what Pond and I2P-Bote are doing with some parts of
this as well.

I don't believe you need a trusted CA/PKI service to successfully
bootstrap users and their addresses/keys into a new global messaging
system. If I want to know what some unknown like Bruce's key is, I'll
look it up on his website, social net, list posts, etc. If that's what you
mean.




From pgut001 at cs.auckland.ac.nz  Sat Dec 14 21:56:32 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Sun, 15 Dec 2013 18:56:32 +1300
Subject: Gmail's receiving mostly authenticated email
In-Reply-To: <20131214213326.56CD5F435@a-pb-sasl-quonix.pobox.com>
Message-ID: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>

Bill Stewart <bill.stewart at pobox.com> writes:

>Saw an interesting article from Gmail on their inbound email statistics. Over
>91% is authenticated with either DKIM or SPF.

What percentage of that is using 512-bit keys?

Peter.




From albill at openbuddha.com  Sun Dec 15 19:01:30 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 19:01:30 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>


From: Juan Garofalo juan.g71 at gmail.com
> > Ha? tor developers admit that the nsa can break tor but schneider  
> says
> otherwise?
>  
> plus, schneier, greenwald and partners don't seem to have too  
> much
> credibility at this point

So you think you know more than Schneier? Do tell.

--  
Al Billings
http://makehacklearn.org  






From coderman at gmail.com  Sun Dec 15 19:01:47 2013
From: coderman at gmail.com (coderman)
Date: Sun, 15 Dec 2013 19:01:47 -0800
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>
References: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
 <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>
Message-ID: <CAJVRA1QQt2vWXX5kju=yLtTGwjkh+bUruxfeSVPPLu0P-w1rYA@mail.gmail.com>

On Sat, Dec 14, 2013 at 11:51 AM, Peter Gutmann
<pgut001 at cs.auckland.ac.nz> wrote:
> [topic hijack in 3.. 2... ]

Peter's BlueHat talk on congitively flawed humans also excellent:
  http://www.cs.auckland.ac.nz/~pgut001/pubs/psychology.pdf


so cypherpunks,  if you write code that you want to be useful:

don't write code with assumptions and admonishments inherently unheedable.

write code with awareness and compensation for silly human inclinations!




From coderman at gmail.com  Sun Dec 15 19:11:44 2013
From: coderman at gmail.com (coderman)
Date: Sun, 15 Dec 2013 19:11:44 -0800
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <CAJVRA1QQt2vWXX5kju=yLtTGwjkh+bUruxfeSVPPLu0P-w1rYA@mail.gmail.com>
References: <CA+cU71nBb+3SW1dgfwWF2dNarYNkwJ5Pmusb_LcbrPFFzJsPyw@mail.gmail.com>
 <E1VrvEx-0004Iv-25@login01.fos.auckland.ac.nz>
 <CAJVRA1QQt2vWXX5kju=yLtTGwjkh+bUruxfeSVPPLu0P-w1rYA@mail.gmail.com>
Message-ID: <CAJVRA1TrhwZO9Asyyg9dem081zzGM9KP0Gy9OaL7+wujkXeGHQ@mail.gmail.com>

On Sun, Dec 15, 2013 at 7:01 PM, coderman <coderman at gmail.com> wrote:
> ...  if you write code that you want to be useful:...
> write code with awareness and compensation for silly human inclinations!

this also implies:
 "There is only one Mode, and it is Secure."
http://iang.org/ssl/h3_there_is_only_one_mode_and_it_is_secure.html




From albill at openbuddha.com  Sun Dec 15 19:25:14 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 19:25:14 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52ae729a.66334873.119c@Al-Retina.local>

Let’s see your implementation, Juan.

From: Juan Garofalo juan.g71 at gmail.com
> > seems to be 'public' knowledge eh
>  
> cryptome.org/2013/08/tor-users-routed.pdf‎(http://cryptome.org/2013/08/tor-users-routed.pdf%E2%80%8E)  
>  

--  
Al Billings
http://makehacklearn.org  






From coderman at gmail.com  Sun Dec 15 19:30:32 2013
From: coderman at gmail.com (coderman)
Date: Sun, 15 Dec 2013 19:30:32 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
Message-ID: <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>

On Sun, Dec 15, 2013 at 6:40 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
>...
>         "the nsa can't break tor"
>
>         Ha? tor developers admit that the nsa can break tor but schneider says
> otherwise?


your understanding is flawed.  let me clarify:

the NSA does not currently break Tor on demand at the protocol level.
all indications are this is currently true.

the NSA and others have great success around Tor by opportunistically
watching users fuck up (see other usability thread), by pwning their
horribly insecure systems (0days as far as the eye can see..), and by
actively manipulating user paths to the Tor network or destination
sites.
"forget your global passive adversary threats, active denial and
manipulation of service attacks are _really_ scary!"


said another way, breaking Tor at protocol level is currently too
expensive a solution to the same ends provided by much cheaper means.




From albill at openbuddha.com  Sun Dec 15 19:41:41 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 19:41:41 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <0F49BE774988ADFFCE28B27D@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <CAFZYV3MB0gN61hNM+_ZF6w-6MBfraSYqDHjsUk4ixejQn+DwRQ@mail.gmail.com>
 <0F49BE774988ADFFCE28B27D@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52ae7675.74b0dc51.119c@Al-Retina.local>

I’m pretty sure that the American government isn’t composed of National Socialists. 

From: Juan Garofalo juan.g71 at gmail.com
> > Also, given the fact that the american nazi government has influenced  
> and
> bribed virtually everybody in the 'security' 'community',  
> isn't it an
> obvious educated guess that Tor, which is directly funded by  
> the american
> nazi governemnt is, let's say, not so trustable?

--  
Al Billings
http://makehacklearn.org  






From albill at openbuddha.com  Sun Dec 15 19:48:39 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 19:48:39 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52ae7817.19495cff.119c@Al-Retina.local>

From: Juan Garofalo juan.g71 at gmail.com

> > > Let's see your implementation, Juan.
>  
>  
> My implementation of what.

Your mechanism for breaking Tor since that paper apparently contains all that you need to do so. Quick, show us your work or are you just some guy bitching on the Internet?

--  
Al Billings
http://makehacklearn.org  






From albill at openbuddha.com  Sun Dec 15 20:00:32 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 20:00:32 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
 <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>


From: Juan Garofalo juan.g71 at gmail.com
> > Are you as fucking stupid as you appear to be?

Funny that you, of all folks, ask this. 

--  
Al Billings
http://makehacklearn.org  






From bill.stewart at pobox.com  Sun Dec 15 20:20:48 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Sun, 15 Dec 2013 20:20:48 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
 <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
Message-ID: <20131216042120.87F4CFC01@a-pb-sasl-quonix.pobox.com>

Juan, Al - I recommend you dig through the Cypherpunks archives to 
read Detweiler's ranting.
He was much more interesting than listening to you to squabble.




From coderman at gmail.com  Sun Dec 15 20:57:56 2013
From: coderman at gmail.com (coderman)
Date: Sun, 15 Dec 2013 20:57:56 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
Message-ID: <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>

On Sun, Dec 15, 2013 at 7:40 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
> ...
>         What is currently true? Even tor developers admit that traffic analysis is
> feasible.

of course.  it's also expensive, relative to other options. i'm saying
NSA spends money carefully.



>         Are you telling me you know all the nsa does? You know they are not big
> enough to attack tor as 'global adversary' or whatever the jargon was?

never said either thing.  i'm also long on the record advocating for
the next generation of low latency anonymous networking that _does_
provide strong defense against traffic analysis.  turns out the
details are, um..  complicated ;)



>         Your reasoning is flawed. Yes, there may use cheaper means if that's all
> they needed. But that does not imply, at all, that other more sophisticated
> means are not available to them.

i'm glad that is not, in fact, my reasoning.

of course there are more sophisticated means available to them; that
will always be the case.  they've got BILLIONS and BILLIONS every
year, for their projects.

the point is not making something "NSA proof", which is an ill defined
and open ended venture.  the point is increasing the cost of their
efforts and narrowing their scope.

the more money they spend getting less and less in return, the better!




From odinn.cyberguerrilla at riseup.net  Sun Dec 15 22:36:34 2013
From: odinn.cyberguerrilla at riseup.net (Odinn Cyberguerrilla)
Date: Sun, 15 Dec 2013 22:36:34 -0800
Subject: Old response to (new?) thing
In-Reply-To: <1387170383.6933.7.camel@anglachel>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <1387170383.6933.7.camel@anglachel>
Message-ID: <1c6347bf123803aa60ab15cae552acbc.squirrel@fruiteater.riseup.net>

Well, that escalated quickly.

Here's an old response to (new?) thing.

https://lilithlela.cyberguerrilla.org/?p=4959

Hopefully not rehashing too much..

This is sounding a bit like the Sept / August 2013 flareup of activity in
which many people were "Ahhhh! oooooh!! Something is so seriously wrong
here!"

So volunteer your time / money etc to fix it...
there's always a solution waiting for someone's action...
:/



> On Mon, 2013-12-16 at 00:40 -0300, Juan Garofalo wrote:
>> > said another way, breaking Tor at protocol level is currently too
>> > expensive a solution
>>
>>         And you know that, how, exactly?
>
> All of the most recently leaked documents pertaining to Tor (from 2007
> to 2011 IIRC) treat it as far too expensive. These documents are largely
> congratulatory for Tor, and most of the fears of the research community
> (correlation attacks in particular) are as yet unrealized.
>
> As coderman says, there are a wide variety of lucrative active attacks
> that the NSA is not shy about using. Given these attacks, there's no
> reason to try to become a global passive adversary or implement
> correlation attacks. You don't need a correlation attack if you've owned
> your target's computing platform with a 0day or several.
>
> To respond to another comment of yours:
>
>
>>         Also, given the fact that the american nazi government has
>> influenced and
>> bribed virtually everybody in the 'security' 'community', isn't it an
>> obvious educated guess that Tor, which is directly funded by the
>> american
>> nazi governemnt is, let's say, not so trustable?
>
> Virtually all academic computer science in the United States is
> government-funded; Tor isn't substantially different.
>
> Further, the Tor developers include people whom the US Government is
> openly hostile towards (Jacob Applebaum), and are generally very
> principled people.
>
> What is your source for the "fact that the american government has
> influenced and bribed virtually everybody in the security community"?
>
> --
> Sent from Ubuntu
>





From albill at openbuddha.com  Sun Dec 15 22:52:39 2013
From: albill at openbuddha.com (Al Billings)
Date: Sun, 15 Dec 2013 22:52:39 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <A54A896AB320EFA33A417D89@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <1387170383.6933.7.camel@anglachel>
 <A54A896AB320EFA33A417D89@F74D39FA044AA309EAEA14B9>
Message-ID: <etPan.52aea337.6b8b4567.3cfc@Al-Retina.local>

From: Juan Garofalo juan.g71 at gmail.com

> > > What is your source for the "fact that the american government  
> has
> > influenced and bribed virtually everybody in the security  
> community"?
>  
> "common sense”

Where can I put in to get my bribe then?

--  
Al Billings
http://makehacklearn.org  






From juan.g71 at gmail.com  Sun Dec 15 18:40:46 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sun, 15 Dec 2013 23:40:46 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
Message-ID: <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 6:11 PM -0800 coderman <coderman at gmail.com>
wrote:

> Video:
>  https://archive.org/details/schneier
> Audio:
>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_sch
> neier/
> 

	"the nsa can't break tor"

	Ha? tor developers admit that the nsa can break tor but schneider says
otherwise? 

	plus, schneier, greenwald and partners don't seem to have too much
credibility at this point

	




> "Join us at Columbia Law School as renowned security expert Bruce
> Schneier talks with Eben Moglen about what we can learn from the
> Snowden documents, the NSA's efforts to weaken global cryptography,
> and how we can keep our own free software tools from being subverted."
>  





From tedks at riseup.net  Sun Dec 15 21:06:23 2013
From: tedks at riseup.net (Ted Smith)
Date: Mon, 16 Dec 2013 00:06:23 -0500
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
Message-ID: <1387170383.6933.7.camel@anglachel>

On Mon, 2013-12-16 at 00:40 -0300, Juan Garofalo wrote:
> > said another way, breaking Tor at protocol level is currently too
> > expensive a solution 
> 
>         And you know that, how, exactly?

All of the most recently leaked documents pertaining to Tor (from 2007
to 2011 IIRC) treat it as far too expensive. These documents are largely
congratulatory for Tor, and most of the fears of the research community
(correlation attacks in particular) are as yet unrealized.

As coderman says, there are a wide variety of lucrative active attacks
that the NSA is not shy about using. Given these attacks, there's no
reason to try to become a global passive adversary or implement
correlation attacks. You don't need a correlation attack if you've owned
your target's computing platform with a 0day or several.

To respond to another comment of yours:


>         Also, given the fact that the american nazi government has
> influenced and
> bribed virtually everybody in the 'security' 'community', isn't it an
> obvious educated guess that Tor, which is directly funded by the
> american
> nazi governemnt is, let's say, not so trustable? 

Virtually all academic computer science in the United States is
government-funded; Tor isn't substantially different.

Further, the Tor developers include people whom the US Government is
openly hostile towards (Jacob Applebaum), and are generally very
principled people. 

What is your source for the "fact that the american government has
influenced and bribed virtually everybody in the security community"?

-- 
Sent from Ubuntu
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131216/c8bbbb95/attachment.sig>

From coderman at gmail.com  Mon Dec 16 00:11:42 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 00:11:42 -0800
Subject: Aqua - a high bandwidth anonymity system that resists traffic analysis
Message-ID: <CAJVRA1T5RkwAA1=Y7TuMrH1+SqFyHLopXMHsquorpZXdtwqqsg@mail.gmail.com>

this seemed to get lost in the hubub over the summer,

---

http://research.microsoft.com/apps/pubs/?id=199302

Towards Efficient Traffic-analysis Resistant Anonymity Networks

Stevens LeBlond, David Choffnes, Wenxuan Zhou, Peter Druschel, Hitesh
Ballani, and Paul Francis
August 2013

Existing IP anonymity systems tend to sacrifice one of low latency,
high bandwidth, or resistance to traffic-analysis. High-latency
mix-nets like Mixminion batch messages to resist traffic-analysis at
the expense of low latency. Onion routing schemes like Tor deliver low
latency and high bandwidth, but are not designed to withstand traffic
analysis. Designs based on DC-nets or broadcast channels resist
traffic analysis and provide low latency, but are limited to low
bandwidth communication.

In this paper, we present the design, implementation, and evaluation
of Aqua, a high bandwidth anonymity system that resists traffic
analysis. We focus on providing strong anonymity for BitTorrent, and
evaluate the performance of Aqua using traces from hundreds of
thousands of actual Bit-Torrent users. We show that Aqua achieves
latency low enough for efficient bulk TCP flows, bandwidth sufficient
to carry BitTorrent traffic with reasonable efficiency, and resistance
to traffic analysis within anonymity sets of hundreds of clients. We
conclude that Aqua represents an interesting new point in the space of
anonymity network designs.




From juan.g71 at gmail.com  Sun Dec 15 19:12:12 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 00:12:12 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
Message-ID: <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 7:01 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> 
> From: Juan Garofalo juan.g71 at gmail.com
>> > Ha? tor developers admit that the nsa can break tor but schneider  
>> says
>> otherwise?
>>  
>> plus, schneier, greenwald and partners don't seem to have too  
>> much
>> credibility at this point
> 
> So you think you know more than Schneier? Do tell.


	seems to be 'public' knowledge eh

	cryptome.org/2013/08/tor-users-routed.pdf‎



	




> 
> --  
> Al Billings
> http://makehacklearn.org  
> 
> 
>  






From jamesdbell8 at yahoo.com  Mon Dec 16 00:15:03 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Mon, 16 Dec 2013 00:15:03 -0800 (PST)
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
Message-ID: <1387181703.62920.YahooMailNeo@web141205.mail.bf1.yahoo.com>

From: Al Billings <albill at openbuddha.com>

To: Juan Garofalo <juan.g71 at gmail.com>; cpunks <cypherpunks at cpunks.org> 
Sent: Sunday, December 15, 2013 7:01 PM
Subject: Re: request for transcript: Bruce Schneier and Eben Moglen discuss a post-Snowden Internet
 
From: Juan Garofalo juan.g71 at gmail.com

>> > Ha? tor developers admit that the nsa can break tor but schneider  
>> says otherwise?
> plus, schneier, greenwald and partners don't seem to have too much
> credibility at this point

>So you think you know more than Schneier? Do tell.
>Al Billings

"knowledge" and "credibility" are two entirely different things.  
For example, Republican John Boehner no doubt has a great deal of "knowledge" about Congressional politics.  But right now, he has very little "credibility" because of his actions vis a vis the Tea Party and Conservatives.
         Jim Bell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2101 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131216/3d0e24ef/attachment.txt>

From coderman at gmail.com  Mon Dec 16 00:27:16 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 00:27:16 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <AD88B0687B667F5ABF7F1F10@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>
 <AD88B0687B667F5ABF7F1F10@F74D39FA044AA309EAEA14B9>
Message-ID: <CAJVRA1Sc4G_6-KvAqbEUx_nrw9uG5vMS8nbEofLh2pcDmQdv1A@mail.gmail.com>

On Sun, Dec 15, 2013 at 11:57 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
> [ a lot of things ... ]

this is all coming to a few conclusions, where we simply disagree:

a) the black budget was leaked, along with other leaks about technical
capabilities and programs and priorities.  intelligence community is
not immune to government budget pressure.  you insist there is a
limitless expansion, and an unlimited technical ability.  i disagree.

b) you insist Tor's origins and funding sources are proof of
malfeasance; they've responded by diversifying funding. (not to
mention scrutiny of Tor by external, mututally un-trusting parties.
you can look at the code yourself, and interface with controller and
path construction yourself, etc.)

c) we both appear to agree that limiting solutions to technical realms
is missing the bigger picture.  yes to political reform that cuts
funding and restricts scope. yes to judicial reforms which demolish
secret orders and secret courts. yes to social measures which value
and reinforce privacy. yes to educational efforts which empower
individuals to make privacy positive decisions, etc.

last but not least, i second the call to fix it.  help write something better!




From juan.g71 at gmail.com  Sun Dec 15 19:29:55 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 00:29:55 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <etPan.52ae729a.66334873.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
Message-ID: <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 7:25 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> Let's see your implementation, Juan.


	My implementation of what.





> 
> From: Juan Garofalo juan.g71 at gmail.com
>> > seems to be 'public' knowledge eh
>>  
>> cryptome.org/2013/08/tor-users-routed.pdf‎(http://cryptome.org/2013/08
>> /tor-users-routed.pdf%E2%80%8E)  
>>  
> 
> --  
> Al Billings
> http://makehacklearn.org  
> 
> 
>  






From juan.g71 at gmail.com  Sun Dec 15 19:32:56 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 00:32:56 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <CAFZYV3MB0gN61hNM+_ZF6w-6MBfraSYqDHjsUk4ixejQn+DwRQ@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <CAFZYV3MB0gN61hNM+_ZF6w-6MBfraSYqDHjsUk4ixejQn+DwRQ@mail.gmail.com>
Message-ID: <0F49BE774988ADFFCE28B27D@F74D39FA044AA309EAEA14B9>



--On Monday, December 16, 2013 1:17 AM -0200 APX 808 <apx.808 at gmail.com>
wrote:

>> From "Traffic correlation" attacks to "NSA being able to break Tor" there
> is a long way.
> 

	Oh really? Traffic correlation is what tells you who is who, so yes, it's
the same as breaking tor. 

	If you mean, stuff encrypted by tor using standard crypto can't be read,
well, maybe that is true. But is not the point.

	
	Also, given the fact that the american nazi government has influenced and
bribed virtually everybody in the 'security' 'community', isn't it an
obvious educated guess that Tor, which is directly funded by the american
nazi governemnt is, let's say, not so trustable? 

	








> 
> On Mon, Dec 16, 2013 at 12:12 AM, Juan Garofalo <juan.g71 at gmail.com>
> wrote:
> 
>> 
>> 
>> --On Sunday, December 15, 2013 7:01 PM -0800 Al Billings
>> <albill at openbuddha.com> wrote:
>> 
>> > 
>> > From: Juan Garofalo juan.g71 at gmail.com
>> >> > Ha? tor developers admit that the nsa can break tor but schneider
>> >> says
>> >> otherwise?
>> >> 
>> >> plus, schneier, greenwald and partners don't seem to have too
>> >> much
>> >> credibility at this point
>> > 
>> > So you think you know more than Schneier? Do tell.
>> 
>> 
>>         seems to be 'public' knowledge eh
>> 
>>         cryptome.org/2013/08/tor-users-routed.pdf
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> > 
>> > --
>> > Al Billings
>> > http://makehacklearn.org
>> > 
>> > 
>> > 
>> 
>> 
>> 
>> 
> 
> 
> -- 
> Pain is the sensation of weakness leaving your body
> http://apx808.blogspot.com
>  





From juan.g71 at gmail.com  Sun Dec 15 19:40:08 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 00:40:08 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
Message-ID: <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 7:30 PM -0800 coderman <coderman at gmail.com>
wrote:

> On Sun, Dec 15, 2013 at 6:40 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
>> ...
>>         "the nsa can't break tor"
>> 
>>         Ha? tor developers admit that the nsa can break tor but
>>         schneider says otherwise?
> 
> 
> your understanding is flawed. 

	If you say so...


> let me clarify:
> 
> the NSA does not currently break Tor on demand at the protocol level.
> all indications are this is currently true.


	What is currently true? Even tor developers admit that traffic analysis is
feasible. 

	Are you telling me you know all the nsa does? You know they are not big
enough to attack tor as 'global adversary' or whatever the jargon was? 
	


> 
> the NSA and others have great success around Tor by opportunistically
> watching users fuck up (see other usability thread), by pwning their
> horribly insecure systems (0days as far as the eye can see..), and by
> actively manipulating user paths to the Tor network or destination
> sites.
> "forget your global passive adversary threats, active denial and
> manipulation of service attacks are _really_ scary!"
> 
> 
> said another way, breaking Tor at protocol level is currently too
> expensive a solution 

	And you know that, how, exactly?


>to the same ends provided by much cheaper means.
>  


	Your reasoning is flawed. Yes, there may use cheaper means if that's all
they needed. But that does not imply, at all, that other more sophisticated
means are not available to them.


	








From juan.g71 at gmail.com  Sun Dec 15 19:51:04 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 00:51:04 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <etPan.52ae7817.19495cff.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
Message-ID: <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 7:48 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> From: Juan Garofalo juan.g71 at gmail.com
> 
>> > > Let's see your implementation, Juan.
>>  
>>  
>> My implementation of what.
> 
> Your mechanism for breaking Tor since that paper apparently contains all
> that you need to do so. Quick, show us your work or are you just some guy
> bitching on the Internet?


	Are you as fucking stupid as you appear to be? 




> 
> --  
> Al Billings
> http://makehacklearn.org  
> 
> 
>  






From coderman at gmail.com  Mon Dec 16 01:09:27 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 01:09:27 -0800
Subject: fallout of NSA induced difficulties (lots of drinking,
 self medication)
Message-ID: <CAJVRA1S5DsjvTA+sDjc8jAarVqDtJRqu3HoBs6pJxqa-h9rrxQ@mail.gmail.com>

this is what happens when large sums of money are secretly spent to
prevent the event of secure inter-net:

(NIST could simply be bought, but IETF had to be turned in on itself..)

;P

---

"IETF PKIX meeting minutes from the 56th IETF"
http://www.cs.auckland.ac.nz/~pgut001/misc/minutes.txt

We were somewhere in San Francisco on the edge of the 56th IETF when
the drugs began to take hold.  I remember saying something like "I
feel a bit
lightheaded; maybe you should take notes...."  And suddenly there was a
terrible roar all around us and the sky was full of what looked like huge
OIDs, all swooping and screeching and diving around the RFC, which was about a
hundred pages long.  And a voice was screaming: "Holy Jesus!  Where are these
goddamn business cases?"

Then it was quiet again.  My attorney had taken his shirt off and was pouring
beer into his mouth, to facilitate the PKI standards-creation process.  "What
the hell are you yelling about?" he muttered, staring up at the neon lights
with his eyes closed and covered with wraparound Spanish sunglasses.  "Never
mind," I said.  "It's your turn to figure out the interop requirements."  I hit
the brakes and dropped the Great Pile of Paperwork at the side of the room.
No point mentioning those OIDs, I thought.  The poor bastard will see them
soon enough.

We had two bags of X.509 standards, seventy-five pages of PKIX mailing list
printouts, five sheets of high-powered constraints, a saltshaker half-full of
vendor hype, and a whole galaxy of requirements, restrictions, promises,
threats...  Also, a quart of OSI, a quart of LDAP, a case of XML, a pint of
raw X.500, and two dozen PGPs.  Not that we needed all that for the trip, but
once you get into a serious PKI RFC binge, the tendency is to push it as far
as you can.  The only thing that really worried me was the X.500.  There is
nothing in the world more helpless and irresponsible and depraved than a man
in the depths of an X.500 binge, and I knew we'd get into that rotten stuff
pretty soon.




From juan.g71 at gmail.com  Sun Dec 15 20:12:05 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 01:12:05 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
 <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
Message-ID: <496B5B3D66EF67EC5C7297E4@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 8:00 PM -0800 Al Billings
<albill at openbuddha.com> wrote:

> 
> From: Juan Garofalo juan.g71 at gmail.com
>> > Are you as fucking stupid as you appear to be?
> 
> Funny that you, of all folks, ask this. 


	You know Al, I wasted a few minutes yesterday checking your posts in the
archive. Of course I didn't find a single post with any kind of really
valuable content.	

	But, I did find the spam in which you whinied about Jim Bell's posts -
which ironically you called spam. Quite telling. 

	And, more interesting, I saw the posts again from a guy who pretended that
US presidents are not bribed...and that was you.

	Now, what kind of person would say such a thing in a list like this...?



> 
> --  
> Al Billings
> http://makehacklearn.org  
> 
> 
>  






From apx.808 at gmail.com  Sun Dec 15 19:17:10 2013
From: apx.808 at gmail.com (APX 808)
Date: Mon, 16 Dec 2013 01:17:10 -0200
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
Message-ID: <CAFZYV3MB0gN61hNM+_ZF6w-6MBfraSYqDHjsUk4ixejQn+DwRQ@mail.gmail.com>

>From "Traffic correlation" attacks to "NSA being able to break Tor" there
is a long way.


On Mon, Dec 16, 2013 at 12:12 AM, Juan Garofalo <juan.g71 at gmail.com> wrote:

>
>
> --On Sunday, December 15, 2013 7:01 PM -0800 Al Billings
> <albill at openbuddha.com> wrote:
>
> >
> > From: Juan Garofalo juan.g71 at gmail.com
> >> > Ha? tor developers admit that the nsa can break tor but schneider
> >> says
> >> otherwise?
> >>
> >> plus, schneier, greenwald and partners don't seem to have too
> >> much
> >> credibility at this point
> >
> > So you think you know more than Schneier? Do tell.
>
>
>         seems to be 'public' knowledge eh
>
>         cryptome.org/2013/08/tor-users-routed.pdf
>
>
>
>
>
>
>
>
> >
> > --
> > Al Billings
> > http://makehacklearn.org
> >
> >
> >
>
>
>
>


-- 
Pain is the sensation of weakness leaving your body
http://apx808.blogspot.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1724 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131216/eb6730b3/attachment.txt>

From juan.g71 at gmail.com  Sun Dec 15 20:18:55 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 01:18:55 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
Message-ID: <1C13C5D0B653574953A03403@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 6:11 PM -0800 coderman <coderman at gmail.com>
wrote:

> Video:
>  https://archive.org/details/schneier
> Audio:
>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_sch
> neier/
> 

	more shameless tor advertising at 31:30

	interestingly enough, the guy asking the questions isn't buying schneier's
bullshit.

 




From juan.g71 at gmail.com  Sun Dec 15 20:36:57 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 01:36:57 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <20131216042120.87F4CFC01@a-pb-sasl-quonix.pobox.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
 <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
 <20131216042120.87F4CFC01@a-pb-sasl-quonix.pobox.com>
Message-ID: <96518D34EF6CA14559C63846@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 8:20 PM -0800 Bill Stewart
<bill.stewart at pobox.com> wrote:

> Juan, Al - I recommend you dig through the Cypherpunks archives to read
> Detweiler's ranting.
> He was much more interesting than listening to you to squabble.
> 
>  


	Thanks for the pointer ^-^





From grarpamp at gmail.com  Sun Dec 15 23:42:43 2013
From: grarpamp at gmail.com (grarpamp)
Date: Mon, 16 Dec 2013 02:42:43 -0500
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <52AE80FD.7060004@echeque.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
 <52AE80FD.7060004@echeque.com>
Message-ID: <CAD2Ti29Rz8SEXZjvjTY17QSc0MC1wm++PRFtrCBJJvbV9C=qtA@mail.gmail.com>

> So if you are communicating with one of these new fangled email addresses,
> you have to have the software that encrypts, and your message is secure -
> because you are not using the old email protocol, though there may something
> on your computer that pretends to use old email protocol for the benefit of
> your client.

I read most of your posts here. But is this a question? A statement?
Please break into parts and rephrase.




From grarpamp at gmail.com  Mon Dec 16 00:01:24 2013
From: grarpamp at gmail.com (grarpamp)
Date: Mon, 16 Dec 2013 03:01:24 -0500
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <52AEA612.3060308@jondos.de>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
 <52AEA612.3060308@jondos.de>
Message-ID: <CAD2Ti284LP3-0i4ycqkMVo3H8U6rEvrFNeOEtz=CYpOPGSDx+w@mail.gmail.com>

> You may have a look of "I2P Bote" it is severless, encrypted mail
> system, address is the public key, P2P based... nice tool.

As in another post of mine, I'll be looking at that again.
My first take was that it stores the messages in the DHT,
which didn't seem scalable or reliable at all. I may be
wrong as I read more later.

> Afterwards you can add the "I2P Bote plugin", the serverless mail
> system. SMTP- and POP3 support was on the ToDo list some times ago, I

I think that's working now. And is the general idea, create a strong
overlay network with a frontend MUA's can speak to.

As an aside: If you can make that overlay net present an IPv6 tunnel
interface on the local host, that lets you use any IPv6 enabled
app over it. I'm doubting the world needs a dozen application
specific overlay networks. More like just a few classes of network.
- message based store and forward
- low latency IPv6 transport
- data storage and retrieval




From juan.g71 at gmail.com  Sun Dec 15 22:34:27 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 03:34:27 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <1387170383.6933.7.camel@anglachel>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <1387170383.6933.7.camel@anglachel>
Message-ID: <A54A896AB320EFA33A417D89@F74D39FA044AA309EAEA14B9>



--On Monday, December 16, 2013 12:06 AM -0500 Ted Smith <tedks at riseup.net>
wrote:

> On Mon, 2013-12-16 at 00:40 -0300, Juan Garofalo wrote:
>> > said another way, breaking Tor at protocol level is currently too
>> > expensive a solution 
>> 
>>         And you know that, how, exactly?
> 
> All of the most recently leaked documents pertaining to Tor (from 2007
> to 2011 IIRC) 

	'if you recall correctly'? 

	Are you aware that this is the end of the year 2013, by the way? 

	Do I need to mention again that tor developers admit that traffic can be
analyzed? 

	Why on earth do you believe that "absence of (outdated)evidence is
evidence of absence"? 



> treat it as far too expensive. These documents are largely
> congratulatory for Tor, and most of the fears of the research community
> (correlation attacks in particular) are as yet unrealized.


	What if you actually read my messages instead of repeating the same
unfounded assertions I've already replied to? 


> 
> As coderman says, there are a wide variety of lucrative active attacks
> that the NSA is not shy about using. Given these attacks, there's no
> reason to try to become a global passive adversary


	Àre you joking? There's no reason for the NSA to be the NSA? 

	the hell are you talking about. 


> or implement
> correlation attacks. You don't need a correlation attack if you've owned
> your target's computing platform with a 0day or several.

	They can do both . And actually, owning the target's computer may be
harder than monitoring the tor network, depending on circumstances.



> 
> To respond to another comment of yours:
> 
> 
>>         Also, given the fact that the american nazi government has
>> influenced and
>> bribed virtually everybody in the 'security' 'community', isn't it an
>> obvious educated guess that Tor, which is directly funded by the
>> american
>> nazi governemnt is, let's say, not so trustable? 
> 
> Virtually all academic computer science in the United States is
> government-funded; Tor isn't substantially different.


	So? Virtually all academic computer science in the US is corrupt. That
isn't news. 


> 
> Further, the Tor developers include people whom the US Government is
> openly hostile towards (Jacob Applebaum), and are generally very
> principled people. 

	So? Applebaum may not get along with the US government, doesn't mean
anything, considering that the other developers are rather friendly to the
US government.

	For fuck's sake they work for the FUCKING US MILITARY.

> 
> What is your source for the "fact that the american government has
> influenced and bribed virtually everybody in the security community"?
> 


	"common sense"




> -- 
> Sent from Ubuntu
>  






From grarpamp at gmail.com  Mon Dec 16 01:03:34 2013
From: grarpamp at gmail.com (grarpamp)
Date: Mon, 16 Dec 2013 04:03:34 -0500
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <1387170383.6933.7.camel@anglachel>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <1387170383.6933.7.camel@anglachel>
Message-ID: <CAD2Ti2-Od+UjU7bjNk0BGqUScy9LV=ixZEZERYodu9b-ytphUA@mail.gmail.com>

Everyone knows there are active attacks against
'Tor' users... ie: the apps they attach to it. Those are
cheap wins for the adversary and unrelated to Tor.

There are attempts to exploit Tor daemon and other various
access to 0wn or run the relays themselves to get at the
plaintext or the service running behind Tor. Not much
to do there but harden Tor and the relays and run more
independant ones. And nobody's cracking the crypto on
the wire anytime soon. Those aren't really related to
Tor, but standard practice.

Tor can have it's hidden services found via various
published attacks involving deploying analysis nodes.
There are caveats, and the cost isn't that much, but
it takes time. It's in the papers.

I'd caution on one debated thing about adversaries... we know
there are at least a few adversaries in the world that have *very*
good regional coverage with network taps. So contrary
to some opinions, I'd suggest it would be rather possible for them
to use those and determine who is talking to who by correlating
traffic passing the taps... if your traffic happened to begin and
end within that region it could be game over. That's in the
papers too.

Low latency nets that do not use fill traffic are simply
not resistant to timing/correlation attacks. Tor is low latency
and does not use fill traffic. It's not a break, it's a design
choice/tradeoff. Depending on how you use these networks,
it may or may not be an issue for you.

Tor was never meant to do everything, yet it's quite good
at what it does, and publishing what it doesn't.




From juan.g71 at gmail.com  Sun Dec 15 23:57:04 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 04:57:04 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>
Message-ID: <AD88B0687B667F5ABF7F1F10@F74D39FA044AA309EAEA14B9>



--On Sunday, December 15, 2013 8:57 PM -0800 coderman <coderman at gmail.com>
wrote:

> On Sun, Dec 15, 2013 at 7:40 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
>> ...
>>         What is currently true? Even tor developers admit that traffic
>>         analysis is feasible.
> 
> of course.  it's also expensive, relative to other options. i'm saying
> NSA spends money carefully.


	Are you saying that government, whose nature is to not be subjected to
'market discipline', government that is able to tax(steal) borrow(cheat)
and spend trillions, spends money carefully? 

	Your remark seems to go against basic economic theory - and practice. 


	
> 
> 
> 
>>         Are you telling me you know all the nsa does? You know they are
>>         not big enough to attack tor as 'global adversary' or whatever
>> the jargon was?
> 
> never said either thing.  i'm also long on the record advocating for
> the next generation of low latency anonymous networking that _does_
> provide strong defense against traffic analysis.  turns out the
> details are, um..  complicated ;)


	Meaning? It's basically impossible to defend against an enemy that
controls the physical infrastructure. The problem here is political, not
technological. Although this is an aside.


> 
> 
> 
>>         Your reasoning is flawed. Yes, there may use cheaper means if
>>         that's all they needed. But that does not imply, at all, that
>> other more sophisticated means are not available to them.
> 
> i'm glad that is not, in fact, my reasoning.
> 
> of course there are more sophisticated means available to them; that
> will always be the case.  they've got BILLIONS and BILLIONS every
> year, for their projects.


	Exactly. And one of objectives is to spend all the money they get, and
more, so that their budget keeps growing. Now we've established that
economic constraints don't mean much to them.
	 

> 
> the point is not making something "NSA proof",

	It isn't? 

	Anyway, here's your original assertion 

	"the NSA does not currently break Tor on demand at the protocol level."

	How do you know that? You don't? On the other hand, to assume that they do
it, or can do it if they want to, is a sensible assumption.

	
	you added 

	"said another way, breaking Tor at protocol level is currently too
expensive a solution to the same ends provided by much cheaper means."

	which to me reads as an attempt at an economic proof of sorts, but the
economics don't add up. 

	Why wouldn't the US governemnt NOT play the role of 'global passive
adversary'? <---- that's a rhetorical question...

	Also, the assumption that they can get exactly the same results by pwning
target computers doesn't seem correct to me. Yes, there may be cases  when
that is true. But is that always true? 



> which is an ill defined
> and open ended venture.  the point is increasing the cost of their
> efforts and narrowing their scope.
> 
> the more money they spend getting less and less in return, the better!


	Not really. The more money they 'need' the more taxes you pay. So, they
get all the resources they want, and you pay. Neat deal huh?


	







>  





From juan.g71 at gmail.com  Mon Dec 16 00:47:23 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 05:47:23 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <CAJVRA1Sc4G_6-KvAqbEUx_nrw9uG5vMS8nbEofLh2pcDmQdv1A@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>
 <AD88B0687B667F5ABF7F1F10@F74D39FA044AA309EAEA14B9>
 <CAJVRA1Sc4G_6-KvAqbEUx_nrw9uG5vMS8nbEofLh2pcDmQdv1A@mail.gmail.com>
Message-ID: <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>



--On Monday, December 16, 2013 12:27 AM -0800 coderman <coderman at gmail.com>
wrote:

> On Sun, Dec 15, 2013 at 11:57 PM, Juan Garofalo <juan.g71 at gmail.com>
> wrote:
>> [ a lot of things ... ]
> 
> this is all coming to a few conclusions, where we simply disagree:
> 
> a) the black budget was leaked, along with other leaks about technical
> capabilities and programs and priorities.  intelligence community is
> not immune to government budget pressure.  you insist there is a
> limitless expansion, and an unlimited technical ability.  i disagree.


	I didn't say limitless. If it sounded that way, let me rephrase to : 

	Governments can spend a lot more money than a 'for-profit' enterprise in a
(hypothetical) free market. Private firms go bankrupt. Governments and
their 'agencies' usually don't.
	
	I'd be surprised if you disagreed too much with that =P


	
> 
> b) you insist Tor's origins and funding sources are proof of
> malfeasance; 

	I didn't say it's direct proof. I do say they are (highly) suspect. But
that was an aside. 


	My point here is that the assertion (paraphrasing) 

	"the nsa doesn't play the global passive adversary game against tor" is
unfounded. 

	Schneier flatly said "they can't break tor" - which is something you don't
even agree as far as I can tell, but you regard as too costly (rather than
impossible)


	
> they've responded by diversifying funding. (not to
> mention scrutiny of Tor by external, mututally un-trusting parties.
> you can look at the code yourself, and interface with controller and
> path construction yourself, etc.)
> 
> c) we both appear to agree that limiting solutions to technical realms
> is missing the bigger picture.  yes to political reform that cuts
> funding and restricts scope. yes to judicial reforms which demolish
> secret orders and secret courts. yes to social measures which value
> and reinforce privacy. yes to educational efforts which empower
> individuals to make privacy positive decisions, etc.
> 
> last but not least, i second the call to fix it.  help write something
> better!  


	Yes, I want to write a one time pad for an arm microcontroller (in
assembler) - OK, that doesn't fix the traffic analysis problem that  tor is
supposed to address, but seems to be a nice solution for encryption that
even the NSA can't break =P


J.

 








From cane at jondos.de  Sun Dec 15 23:04:50 2013
From: cane at jondos.de (cane)
Date: Mon, 16 Dec 2013 07:04:50 +0000
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
Message-ID: <52AEA612.3060308@jondos.de>

grarpamp:
> some form of p2p message system where every address is a crypto key,
> masked for grandma by her contact list

You may have a look of "I2P Bote" it is severless, encrypted mail
system, address is the public key, P2P based... nice tool.

  https://en.wikipedia.org/wiki/I2P#E-mail

It is part of the Invisible Internet Project (I2P), a P2P darknet.
The I2P router is router and client in one Java application. You have to
install he I2P router first: http://www.i2p2.de

Afterwards you can add the "I2P Bote plugin", the serverless mail
system. SMTP- and POP3 support was on the ToDo list some times ago, I
didn't have a look on the latest version of the project.

Installation is not very easy, but possible.

Best regards
cane




From coderman at gmail.com  Mon Dec 16 08:20:32 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 08:20:32 -0800
Subject: Wyden spends weeks preparing for questions to intelligence officials
Message-ID: <CAJVRA1SR8MuXr7zQtbj+NZt+2LocBEDOZF-ce5Mn+paQqp=+Hw@mail.gmail.com>

an interesting read on the state of things.

Wyden does Oregon proud,


[only excerpted, whole thing is huge. waiting for cryptome to mirror... ]
http://www.newyorker.com/reporting/2013/12/16/131216fa_fact_lizza?currentPage=all
"""
Wyden estimates that he gets about fifteen minutes a year to ask
questions of top intelligence officials at open hearings. With the
help of his intelligence staffer, John Dickas, a thirty-five-year-old
from Beaverton, Oregon, whom Wyden calls “the hero of the
intelligence-reform movement,” Wyden often spends weeks preparing his
questions. He and Dickas look for opportunities to interrogate
officials on the gaps between what they say in public and what they
say in classified briefings. At a technology conference in Nevada the
previous summer, General Keith Alexander, the director of the N.S.A.,
had said that “the story that we have millions or hundreds of millions
of dossiers on people is absolutely false.” Wyden told me recently,
“It sure didn’t sound like the world I heard about in private.” For
months, he tried to get a clarification from the N.S.A. about exactly
what Alexander had meant. Now he had the opportunity to ask Clapper in
public. As a courtesy, he had sent him the question the day before.

Wyden leaned forward and read Alexander’s comment. Then he asked,
“What I wanted to see is if you could give me a yes or no answer to
the question ‘Does the N.S.A. collect any type of data at all on
millions or hundreds of millions of Americans?’ ”

Clapper slouched in his chair. He touched the fingertips of his right
hand to his forehead and made a fist with his left hand.

“No, sir,” he said. He gave a quick shake of his head and looked down
at the table.

“It does not?” Wyden asked, with exaggerated surprise.

“Not wittingly,” Clapper replied. He started scratching his forehead
and looked away from Wyden. “There are cases where they could
inadvertently perhaps collect, but not wittingly.”

Wyden told me, “The answer was obviously misleading, false.”
"""




From coderman at gmail.com  Mon Dec 16 08:29:55 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 08:29:55 -0800
Subject: Bruce Schneier to leave BT
Message-ID: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>

retaliation for helping expose intelligence community excesses and illegalities?




From cane at jondos.de  Mon Dec 16 01:07:29 2013
From: cane at jondos.de (cane)
Date: Mon, 16 Dec 2013 09:07:29 +0000
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <CAD2Ti284LP3-0i4ycqkMVo3H8U6rEvrFNeOEtz=CYpOPGSDx+w@mail.gmail.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
 <52AEA612.3060308@jondos.de>
 <CAD2Ti284LP3-0i4ycqkMVo3H8U6rEvrFNeOEtz=CYpOPGSDx+w@mail.gmail.com>
Message-ID: <52AEC2D1.7000308@jondos.de>

grarpamp:
> As in another post of mine, I'll be looking at that again.

I see, sorry - I am new on the list.

> My first take was that it stores the messages in the DHT,

Yes, it uses a DHT. Messages are stored with 20x redundancy.

cane




From carimachet at gmail.com  Mon Dec 16 01:00:05 2013
From: carimachet at gmail.com (Cari Machet)
Date: Mon, 16 Dec 2013 10:00:05 +0100
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <CAJVRA1SBz8gnvvjf+5RTQES3K6+ktFc=5G4x5sHAbKn74z238A@mail.gmail.com>
 <96FE801A2AC46A4FC7645B21@F74D39FA044AA309EAEA14B9>
 <CAJVRA1QE_+CEho27cTTRVpPqStvn5WMRdM6TxEpNTbPOv7RSsQ@mail.gmail.com>
 <AD88B0687B667F5ABF7F1F10@F74D39FA044AA309EAEA14B9>
 <CAJVRA1Sc4G_6-KvAqbEUx_nrw9uG5vMS8nbEofLh2pcDmQdv1A@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
Message-ID: <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>

tonight in the us of agh  on 60 minutes they had on a giant ad for the NSA

fr what i understand alexander has his office set up as star trek battleship

and this was really weird they do standing meetings with a blue light on
where he gets a report read to him - they gave the appearance of children
playing a game

they said every summer they have high school student interns break code for
them and they are highly successful

i just wonder if ppl are thinking about the bio sphere at all in terms of
some sort of 'encryption' method i mean if we can work outside of the
little box they have made for themselves (and us) then  mayb things r
movable?

Cari Machet
NYC 646-436-7795
carimachet at gmail.com
AIM carismachet
Skype carimachet - 646-652-6434
Syria +963-099 277 3243
Amman +962 077 636 9407
Berlin +49 152 11779219
Twitter: @carimachet <https://twitter.com/carimachet>

Ruh-roh, this is now necessary: This email is intended only for the
addressee(s) and may contain confidential information. If you are not the
intended recipient, you are hereby notified that any use of this
information, dissemination, distribution, or copying of this email without
permission is strictly prohibited.



On Mon, Dec 16, 2013 at 9:47 AM, Juan Garofalo <juan.g71 at gmail.com> wrote:

>
>
> --On Monday, December 16, 2013 12:27 AM -0800 coderman <coderman at gmail.com
> >
> wrote:
>
> > On Sun, Dec 15, 2013 at 11:57 PM, Juan Garofalo <juan.g71 at gmail.com>
> > wrote:
> >> [ a lot of things ... ]
> >
> > this is all coming to a few conclusions, where we simply disagree:
> >
> > a) the black budget was leaked, along with other leaks about technical
> > capabilities and programs and priorities.  intelligence community is
> > not immune to government budget pressure.  you insist there is a
> > limitless expansion, and an unlimited technical ability.  i disagree.
>
>
>         I didn't say limitless. If it sounded that way, let me rephrase to
> :
>
>         Governments can spend a lot more money than a 'for-profit'
> enterprise in a
> (hypothetical) free market. Private firms go bankrupt. Governments and
> their 'agencies' usually don't.
>
>         I'd be surprised if you disagreed too much with that =P
>
>
>
> >
> > b) you insist Tor's origins and funding sources are proof of
> > malfeasance;
>
>         I didn't say it's direct proof. I do say they are (highly)
> suspect. But
> that was an aside.
>
>
>         My point here is that the assertion (paraphrasing)
>
>         "the nsa doesn't play the global passive adversary game against
> tor" is
> unfounded.
>
>         Schneier flatly said "they can't break tor" - which is something
> you don't
> even agree as far as I can tell, but you regard as too costly (rather than
> impossible)
>
>
>
> > they've responded by diversifying funding. (not to
> > mention scrutiny of Tor by external, mututally un-trusting parties.
> > you can look at the code yourself, and interface with controller and
> > path construction yourself, etc.)
> >
> > c) we both appear to agree that limiting solutions to technical realms
> > is missing the bigger picture.  yes to political reform that cuts
> > funding and restricts scope. yes to judicial reforms which demolish
> > secret orders and secret courts. yes to social measures which value
> > and reinforce privacy. yes to educational efforts which empower
> > individuals to make privacy positive decisions, etc.
> >
> > last but not least, i second the call to fix it.  help write something
> > better!
>
>
>         Yes, I want to write a one time pad for an arm microcontroller (in
> assembler) - OK, that doesn't fix the traffic analysis problem that  tor is
> supposed to address, but seems to be a nice solution for encryption that
> even the NSA can't break =P
>
>
> J.
>
>
>
>
>
>
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4901 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131216/d7ea21c5/attachment.txt>

From gfoster at entersection.org  Mon Dec 16 08:54:56 2013
From: gfoster at entersection.org (Gregory Foster)
Date: Mon, 16 Dec 2013 10:54:56 -0600
Subject: Alleged NSA co-worker describes Snowden
Message-ID: <52AF3060.8060201@entersection.org>

Forbes (Dec 16) - "An NSA Coworker Remembers The Real Edward Snowden: 'A
Genius Among Geniuses'" by @a_greenberg:
http://www.forbes.com/sites/andygreenberg/2013/12/16/an-nsa-coworker-remembers-the-real-edward-snowden-a-genius-among-geniuses/

> The anonymous NSA staffer’s priority in contacting me, in fact, was to refute stories that have surfaced as the NSA and the media attempt to explain how a contractor was able to obtain and leak the tens of thousands of highly classified documents that have become the biggest public disclosure of NSA secrets in history. According to the source, Snowden didn’t dupe coworkers into handing over their passwords, as one report has claimed. Nor did Snowden fabricate SSH keys to gain unauthorized access, he or she says.
>
> Instead, there’s little mystery as to how Snowden gained his access: It was given to him. 

HT @WeldPond:
https://twitter.com/WeldPond/status/412623997272989697

gf

-- 
Gregory Foster || gfoster at entersection.org
@gregoryfoster <> http://entersection.com/




From adi at hexapodia.org  Mon Dec 16 11:54:55 2013
From: adi at hexapodia.org (Andy Isaacson)
Date: Mon, 16 Dec 2013 11:54:55 -0800
Subject: Bruce Schneier to leave BT
In-Reply-To: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>
References: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>
Message-ID: <20131216195455.GX6895@hexapodia.org>

On Mon, Dec 16, 2013 at 08:29:55AM -0800, coderman wrote:
> retaliation for helping expose intelligence community excesses and
> illegalities?

Unlikely; not impossible, but I doubt it was actual retaliation.  Bruce
denies it:
http://www.theregister.co.uk/2013/12/16/bruce_schneier_leaves_bt/

    Schneier told The Register this evening of his departure: "This has
    nothing to do with the NSA. No, they [BT] weren't happy with me, but
    they knew that I am an independent thinker and they didn't try to
    muzzle me in any way. It's just time. I spent seven years at BT, and
    seven years at Counterpane Internet Security, Inc before BT bought
    us. It's past time for something new.
    
    As to the future: Answer, cloudy; ask again later." 

Circa 2009 Bruce had some amusing off-the-record stories of previous
interactions with the BT hierarchy.  Bruce at BT was never a clean fit,
but BT profited greatly by, as they say in the article's leaked email,
having someone who can challenge their expectations.

Staying at a single gig for 14 years is quite remarkable in the tech
industry.

All that said, there are still things that one Cannot Say when one has
$CORP on one's business card.  Just as a simple example, the doctrine
of "judicial notice" means that if an officer of a corporation makes a
public statement about something and the corporation does not publish a
correction, a court can assume that the statement is true in a later
civil proceeding.  The company can counter the presumption or clarify
the necessary context by presenting evidence, but it's expensive and
means you're burning minutes/pages on refuting nonsense.  So execs need
to be careful not to say, for example, that "$CORP has poor network
security" because that's food for a nuisance lawsuit.

I hope Bruce can use his newfound free time to do additional reporting
on the docs.  Good news!

-andy




From jya at pipeline.com  Mon Dec 16 09:14:19 2013
From: jya at pipeline.com (John Young)
Date: Mon, 16 Dec 2013 12:14:19 -0500
Subject: Wyden spends weeks preparing for questions to intelligence
 officials
In-Reply-To: <CAJVRA1SR8MuXr7zQtbj+NZt+2LocBEDOZF-ce5Mn+paQqp=+Hw@mail.g
 mail.com>
References: <CAJVRA1SR8MuXr7zQtbj+NZt+2LocBEDOZF-ce5Mn+paQqp=+Hw@mail.gmail.com>
Message-ID: <E1VsbjV-0000Yr-Hx@elasmtp-mealy.atl.sa.earthlink.net>

http://cryptome.org/2013/12/spies-reign-obama.htm







From jya at pipeline.com  Mon Dec 16 09:32:46 2013
From: jya at pipeline.com (John Young)
Date: Mon, 16 Dec 2013 12:32:46 -0500
Subject: Bruce Schneier to leave BT
In-Reply-To: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.g
 mail.com>
References: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>
Message-ID: <E1Vsc1C-0000Qg-M7@elasmtp-galgo.atl.sa.earthlink.net>

Would be great for the other dual-hats to follow Schneier's example,
with fuller accounts of what has been going on behind NDAs and
clearances. A dripped released is hardly sufficient, maybe justifiably
suspicious.

Remains to be seen if all spy ties are severed or just go darker
and deeper, as usual, into the repurposed Black Chamber to
hide with celebrity and outrage what is blatantly devious -- in
the crypto legacy manner.

Isn't that what this unfettered open forum dumpster is urging
duplicitously from DoB of cryptoanarchy?

Whither cryptoanarchy's billionaire, if not TLAs, Soros, Sim,
Murdoch, Gates, Ellison, Bezos, Omidyar, Kochs, Saudis,
Russians, Windsors, China, Kuwait, Oman, Ford, Rockefeller,
so many, so sneaky.

As Assange said to early charges of CIA/Soros funding,
"we should be so lucky, all donations welcomed." Word.

At 11:29 AM 12/16/2013, you wrote:
>retaliation for helping expose intelligence community excesses and 
>illegalities?





From jamesd at echeque.com  Sun Dec 15 20:26:37 2013
From: jamesd at echeque.com (James A. Donald)
Date: Mon, 16 Dec 2013 14:26:37 +1000
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
Message-ID: <52AE80FD.7060004@echeque.com>

On 2013-12-15 21:09, grarpamp wrote:
>> Phillip H-B, et al have been saying...
>> [email encryption, etc]
>> What is the gap we have to close to turn this on by default?
>
> How many times has this been rehashed the last six months?
> You can't fix email as we know it today using todays bolt-ons,
> protocols and corporate stakeholders/services trying to profit from it.
> The only way to have any real global seamless success is to go
> ground up with a completely new model. IMO, that will be some
> form of p2p message system where every address is a crypto key,
> masked for grandma by her contact list, decrypted out your p2p
> daemon and piped into your local mail processing (MUA/filter/lists)
> and filesystem (encryption). At least that way your local mail tools
> will still work (no one will give those up anyway).

So if you are communicating with one of these new fangled email 
addresses, you have to have the software that encrypts, and your message 
is secure - because you are not using the old email protocol, though 
there may something on your computer that pretends to use old email 
protocol for the benefit of your client.





From jon at callas.org  Mon Dec 16 15:28:56 2013
From: jon at callas.org (Jon Callas)
Date: Mon, 16 Dec 2013 15:28:56 -0800
Subject: Gmail's receiving mostly authenticated email
In-Reply-To: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
References: <E1Vs4gq-00089j-Sd@login01.fos.auckland.ac.nz>
Message-ID: <DAFB0103-D977-411D-9C27-AFD7D023D37E@callas.org>


On Dec 14, 2013, at 9:56 PM, Peter Gutmann <pgut001 at cs.auckland.ac.nz> wrote:

> Bill Stewart <bill.stewart at pobox.com> writes:
> 
>> Saw an interesting article from Gmail on their inbound email statistics. Over
>> 91% is authenticated with either DKIM or SPF.
> 
> What percentage of that is using 512-bit keys?

Zero. DKIM requires at least a 1024-bit key. Whatever you might want to say about those is a different discussion.

SPF is non-cryptographic authentication.

	Jon





From jya at pipeline.com  Mon Dec 16 13:02:53 2013
From: jya at pipeline.com (John Young)
Date: Mon, 16 Dec 2013 16:02:53 -0500
Subject: Bruce Schneier to leave BT
In-Reply-To: <0D4A6C6A-DE8E-4348-A516-5C6787248127@erratasec.com>
References: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>
 <E1Vsc1C-0000Qg-M7@elasmtp-galgo.atl.sa.earthlink.net>
 <0D4A6C6A-DE8E-4348-A516-5C6787248127@erratasec.com>
Message-ID: <E1VsfIY-0005GV-1y@elasmtp-scoter.atl.sa.earthlink.net>

At 03:30 PM 12/16/2013, you wrote:
>What do you consider to be a dual-hat?

Working on classified and unclassified projects on the same
or related topics, subject to NDAs and secrecy clearance agreements.
While also working the public celebrity arena leaking hints and yarps
about what's behind the cloak that cannot be disclosed.

Corresponds roughly to dual-use technology, such as, notably,
crypto, nuclear, biological, chemical, radiological. These and much
other dual-use technology are fulsomely described in global export
control regimes, like the Wassenaar Arrangement. But quite a
few dual-use controls are themselves secret. Finance gets a lot
of open and classified attention. Crypto is a pretty good pathfinder
to trace the other technologies and their profiteers, so it gets a
special place in the pantheon of lucrative treachery, right up
there next to law and politics, all dual-hatted, so duplictious that
mere duality of forked-tongues should be understood as
over-simplification.






From jamesd at echeque.com  Mon Dec 16 01:23:18 2013
From: jamesd at echeque.com (James A. Donald)
Date: Mon, 16 Dec 2013 19:23:18 +1000
Subject: [Cryptography] Size of the PGP userbase?
In-Reply-To: <CAD2Ti29Rz8SEXZjvjTY17QSc0MC1wm++PRFtrCBJJvbV9C=qtA@mail.gmail.com>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
 <52AE80FD.7060004@echeque.com>
 <CAD2Ti29Rz8SEXZjvjTY17QSc0MC1wm++PRFtrCBJJvbV9C=qtA@mail.gmail.com>
Message-ID: <52AEC686.5000306@echeque.com>

On 2013-12-16 17:42, grarpamp wrote:
>> So if you are communicating with one of these new fangled email addresses,
>> you have to have the software that encrypts, and your message is secure -
>> because you are not using the old email protocol, though there may something
>> on your computer that pretends to use old email protocol for the benefit of
>> your client.
>
> I read most of your posts here. But is this a question? A statement?
> Please break into parts and rephrase.

It is my understanding of the proposed replacement for email.  Magic 
email addresses that in fact correspond to an identifier of a public 
key, for example the hash of a rule that identifies the public key, and 
which result in your message not in fact being passed along by email 
protocols.





From coderman at gmail.com  Mon Dec 16 19:27:34 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 19:27:34 -0800
Subject: RDRAND used directly when default engines loaded in
 openssl-1.0.1-beta1 through openssl-1.0.1e
In-Reply-To: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
References: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
Message-ID: <CAJVRA1St=tXDdv59Ya7TQjWFyrCiCWH4GySgGLoQxm3ZLduwag@mail.gmail.com>

On Sat, Dec 14, 2013 at 4:33 AM, coderman <coderman at gmail.com> wrote:
> ...
> if you are using an application linked with openssl-1.0.1-beta1
> through openssl-1.0.1e you should do one of the following:


updated list with env suggestion:

a.) rebuild your OpenSSL with OPENSSL_NO_RDRAND defined

b.) call ENGINE_unregister_RAND() on "rdrand" engine followed by
ENGINE_register_all_complete() to unregister rdrand as default

c.) set OPENSSL_ia32cap="~0x4000000000000000" in global environment
(this is poor fix)

d.) git pull latest openssl with commit: "Don't use rdrand engine as
default unless explicitly requested." - Dr. Stephen Henson



"what is affected??" - someone

sorry, i am not your distro maintainer.  but the list includes,
potentially (depending on configure opts / runtime / etc):
RHEL 6.5, 7.0
Centos 6.5
Fedora 18,19,rawhide
Ubuntu 12.04, 12.10, 13.04, 13.10, trusty
Debian 7.0, jessie, sid
Gentoo stable&unstable
Knoppix 7.0.5, 7.2.0
Kali 1.0.5
Slackware 14, 14.1, current
... if ssh built with --with-ssl-engine. these all use OpenSSL 1.0.1+.
 (remember both ssh client and server may use engines!)

and other libs, like:
M2Crypto
libpam-sshagent-auth
encfs
... which appear to use OpenSSL default engines.


but really, you should go check your shit.



best regards,


P.S. if anyone is aware of RDRAND engine backports to OpenSSL 1.0.0*
or 0.9.8* in any distros i'd like to know about it!




From coderman at gmail.com  Mon Dec 16 19:30:50 2013
From: coderman at gmail.com (coderman)
Date: Mon, 16 Dec 2013 19:30:50 -0800
Subject: Aqua - a high bandwidth anonymity system that resists traffic
 analysis
In-Reply-To: <1510892.DPo3hhB2I8@lap>
References: <CAJVRA1T5RkwAA1=Y7TuMrH1+SqFyHLopXMHsquorpZXdtwqqsg@mail.gmail.com>
 <1510892.DPo3hhB2I8@lap>
Message-ID: <CAJVRA1TF=-3ej3C=ANm0-X6c92UwqBz5JkE0p1on4YBpop1mdA@mail.gmail.com>

On Mon, Dec 16, 2013 at 5:30 PM, rysiek <rysiek at hackerspace.pl> wrote:
> ...
> WUT? Microsoft doing such research? And sharing info on it?..


i had this same reaction when i found their Link Quality Source
Routing mesh protocol research[0].  crazy times! ;)



0. "Self Organizing Wireless Mesh Networks"
  http://research.microsoft.com/en-us/projects/mesh/




From adi at hexapodia.org  Mon Dec 16 19:39:30 2013
From: adi at hexapodia.org (Andy Isaacson)
Date: Mon, 16 Dec 2013 19:39:30 -0800
Subject: Aqua - a high bandwidth anonymity system that resists traffic
 analysis
In-Reply-To: <CAJVRA1TF=-3ej3C=ANm0-X6c92UwqBz5JkE0p1on4YBpop1mdA@mail.gmail.com>
References: <CAJVRA1T5RkwAA1=Y7TuMrH1+SqFyHLopXMHsquorpZXdtwqqsg@mail.gmail.com>
 <1510892.DPo3hhB2I8@lap>
 <CAJVRA1TF=-3ej3C=ANm0-X6c92UwqBz5JkE0p1on4YBpop1mdA@mail.gmail.com>
Message-ID: <20131217033930.GK6895@hexapodia.org>

On Mon, Dec 16, 2013 at 07:30:50PM -0800, coderman wrote:
> On Mon, Dec 16, 2013 at 5:30 PM, rysiek <rysiek at hackerspace.pl> wrote:
> > WUT? Microsoft doing such research? And sharing info on it?..
> 
> i had this same reaction when i found their Link Quality Source
> Routing mesh protocol research[0].  crazy times! ;)
> 
> 0. "Self Organizing Wireless Mesh Networks"
>   http://research.microsoft.com/en-us/projects/mesh/

MS Research is trying fairly hard to be a Real Research Lab in the vein
of DEC SRC, Xerox PARC, IBM Almaden.  They released a NetBSD kernel for
their experimental CPU a few years back.

http://research.microsoft.com/en-us/downloads/754fee75-c5a0-4542-bf9b-47f236c0a90b/

Strange days we live in.

-andy




From dave at erratasec.com  Mon Dec 16 12:30:04 2013
From: dave at erratasec.com (David Maynor)
Date: Mon, 16 Dec 2013 20:30:04 +0000
Subject: Bruce Schneier to leave BT
In-Reply-To: <E1Vsc1C-0000Qg-M7@elasmtp-galgo.atl.sa.earthlink.net>
References: <CAJVRA1SPHJFW38UtQR7pfhTP6a2mJy7drAQABFUS2afAjgzd8w@mail.gmail.com>
 <E1Vsc1C-0000Qg-M7@elasmtp-galgo.atl.sa.earthlink.net>
Message-ID: <0D4A6C6A-DE8E-4348-A516-5C6787248127@erratasec.com>

What do you consider to be a dual-hat?

On Dec 16, 2013, at 12:32 PM, John Young <jya at pipeline.com> wrote:

> Would be great for the other dual-hats to follow Schneier's example,
> with fuller accounts of what has been going on behind NDAs and
> clearances. A dripped released is hardly sufficient, maybe justifiably
> suspicious.
> 
> Remains to be seen if all spy ties are severed or just go darker
> and deeper, as usual, into the repurposed Black Chamber to
> hide with celebrity and outrage what is blatantly devious -- in
> the crypto legacy manner.
> 
> Isn't that what this unfettered open forum dumpster is urging
> duplicitously from DoB of cryptoanarchy?
> 
> Whither cryptoanarchy's billionaire, if not TLAs, Soros, Sim,
> Murdoch, Gates, Ellison, Bezos, Omidyar, Kochs, Saudis,
> Russians, Windsors, China, Kuwait, Oman, Ford, Rockefeller,
> so many, so sneaky.
> 
> As Assange said to early charges of CIA/Soros funding,
> "we should be so lucky, all donations welcomed." Word.
> 
> At 11:29 AM 12/16/2013, you wrote:
>> retaliation for helping expose intelligence community excesses and illegalities?
> 
> 





From juan.g71 at gmail.com  Mon Dec 16 18:34:22 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 16 Dec 2013 23:34:22 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <52AFAC5F.7000106@appelbaum.net>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <52AFAC5F.7000106@appelbaum.net>
Message-ID: <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>



--On Tuesday, December 17, 2013 1:43 AM +0000 Jacob Appelbaum
<jacob at appelbaum.net> wrote:

> Juan Garofalo:
>> 
>> 
>> --On Sunday, December 15, 2013 6:11 PM -0800 coderman
>> <coderman at gmail.com> wrote:
>> 
>>> Video:
>>>  https://archive.org/details/schneier
>>> Audio:
>>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_s
>>>  ch neier/
>>> 
>> 
>> 	"the nsa can't break tor"
>> 
>> 	Ha? tor developers admit that the nsa can break tor but schneider says
>> otherwise? 
> 
> Where do we admit that the NSA can break Tor? We have seen evidence only
> for the NSA exploiting the code in Tor Browser (Firefox) and never in
> the core Tor network software.


	See my next messages. I'm referring to the "users get router" paper. 

	I see no reason to believe that the NSA can't find out who's who in the
tor network. 

	

> 
>> 
>> 	plus, schneier, greenwald and partners don't seem to have too much
>> credibility at this point
>> 
> 
> Why is that?


	Because they have access to a lot of information they are not publishing,
and have close ties to the establishment. 

	Plus, isn't the latest news that greenwald was bribed/bought by ebays
owner, who happens to be the typical fake american 'libertarian' (he's
actually a mercantilist conservative - see what kind of 'free' market ebay
is)

	

> 
> All the best,
> Jacob
> 
>  





From dan at geer.org  Mon Dec 16 21:08:32 2013
From: dan at geer.org (dan at geer.org)
Date: Tue, 17 Dec 2013 00:08:32 -0500
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed by
 Stewart Baker
In-Reply-To: Your message of "Sat, 14 Dec 2013 10:36:56 PST."
 <CAJVRA1Sh_nDBe_3VKOBkh2oaOTy_QjKErHY_NXdd2OHxb6A_EQ@mail.gmail.com>
Message-ID: <20131217050832.BDD772280D1@palinka.tinho.net>


 > They pretty much symbolise the two sides of the global scandal of the year.
 > 
 > They also symbolise the attitudes of both sides.

Those considered hard right and those considered hard left have never
been closer in outlook, never had greater congruence between their
lists of what to overturn.  Once it is both ends against the middle,
you enter a pre-revolutionary state.  That is what we have now --
growing flanks versus a contracting middle.  It is middle class that
is shrinking; it is the middle of the country that is depopulating;
the political middle is where "only the lonely" live; both farms
and banks are now only too small to matter or too big to fail; all
journalism is now advocacy journalism; middle-tier college education
is a ticket to debt and nothing else; etc.

Conspiracy bait: Stew was Mark Shuttleworth's attorney for the Thawte
acquisition and went with him to the Baikonur Cosmodrome.

--dan




From juan.g71 at gmail.com  Mon Dec 16 19:40:32 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Tue, 17 Dec 2013 00:40:32 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <52AFBF01.3040608@appelbaum.net>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <52AFAC5F.7000106@appelbaum.net>
 <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>
 <52AFBF01.3040608@appelbaum.net>
Message-ID: <6F4CEC544340D54F1C1A002E@F74D39FA044AA309EAEA14B9>



--On Tuesday, December 17, 2013 3:03 AM +0000 Jacob Appelbaum
<jacob at appelbaum.net> wrote:

> Juan Garofalo:
>> 
>> 
>> --On Tuesday, December 17, 2013 1:43 AM +0000 Jacob Appelbaum
>> <jacob at appelbaum.net> wrote:
>> 
>>> Juan Garofalo:
>>>> 
>>>> 
>>>> --On Sunday, December 15, 2013 6:11 PM -0800 coderman
>>>> <coderman at gmail.com> wrote:
>>>> 
>>>>> Video:
>>>>>  https://archive.org/details/schneier
>>>>> Audio:
>>>>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce
>>>>>  _s ch neier/
>>>>> 
>>>> 
>>>> 	"the nsa can't break tor"
>>>> 
>>>> 	Ha? tor developers admit that the nsa can break tor but schneider says
>>>> otherwise? 
>>> 
>>> Where do we admit that the NSA can break Tor? We have seen evidence only
>>> for the NSA exploiting the code in Tor Browser (Firefox) and never in
>>> the core Tor network software.
>> 
>> 
>> 	See my next messages. I'm referring to the "users get router" paper. 
>> 
> 
> Wait, you're taking an academic paper, a good one I might add, and
> saying that this counts as admission by the Tor Project that our efforts
> are futile?


	The paper states that traffic analysis is feasible. I mean, that isn't
exactly news. The paper seems to admit that traffic analysis is (a lot?)
easier that previously supposed. 

	So, yes, that shows that tor can't protect people from the US government.
Which actually shouldn't be surprising since tor is a tool of the US
government. 

	As to your 'efforts being futile' - that's not my wording. Depending on
what your ends are, your efforts are certainly not futile...



> 
>> 	I see no reason to believe that the NSA can't find out who's who in the
>> tor network. 
> 
> Perhaps the leaked documents that specifically state this fact might
> clue you into their capabilities?


	Oh, come on. Again "absence of evidence is not evidence of absence". 

> 
> I encourage you to read them:
> 
>   http://media.encrypted.cc/files/nsa/

	I've already seen a few of them. No, I obviously don't think that those
prove anything. Did I mention that "absence of evidence is not evidence of
absence"? 


	And while we're it, did I miss any leaked documents discussing traffic
analysis of tor? There should be some no?

> 
> Contained in those files, I see no evidence for your assertions. Aaron's
> paper is good but as Al said, feel free to show us some evidence that
> you've used it to break Tor!


	I really can't believe you wrote that. You think I'm that stupid? 

	The way to 'break' tor, that is, find things like the location of, say,
freedom hosting and silk road, is to monitor traffic. I obviously can't do
that. Your government can obviously do that. 

	Please.

> 
>> 
>> 	
>> 
>>> 
>>>> 
>>>> 	plus, schneier, greenwald and partners don't seem to have too much
>>>> credibility at this point
>>>> 
>>> 
>>> Why is that?
>> 
>> 
>> 	Because they have access to a lot of information they are not
>> 	publishing, and have close ties to the establishment. 
> 
> Wait, they have access to information, that they publish, story by story
> and that means that they're not credible? That is hilariously strange
> reasoning. 


	What's hilarious is your attempt at twisting what I said. 


> The information is coming out as quickly as people are able
> to make sense of it.


	Oh really. I need to be spoon fed by computer illiterate greenwald? That's
cool...

	And how do these superior people gauge the rate at which the inferior
people they spoon fed are able to consume what they are given? Just
curious...



> 
>> 
>> 	Plus, isn't the latest news that greenwald was bribed/bought by ebays
>> owner, who happens to be the typical fake american 'libertarian' (he's
>> actually a mercantilist conservative - see what kind of 'free' market
>> ebay is)
> 
> No, the latest news is that Glenn still has nouns of steel and is still
> publishing incredible news on a regular basis.


	OK...



> 
> All the best,
> Jacob
> 
>  





From jacob at appelbaum.net  Mon Dec 16 17:43:59 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 17 Dec 2013 01:43:59 +0000
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
Message-ID: <52AFAC5F.7000106@appelbaum.net>

Juan Garofalo:
> 
> 
> --On Sunday, December 15, 2013 6:11 PM -0800 coderman <coderman at gmail.com>
> wrote:
> 
>> Video:
>>  https://archive.org/details/schneier
>> Audio:
>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_sch
>> neier/
>>
> 
> 	"the nsa can't break tor"
> 
> 	Ha? tor developers admit that the nsa can break tor but schneider says
> otherwise? 

Where do we admit that the NSA can break Tor? We have seen evidence only
for the NSA exploiting the code in Tor Browser (Firefox) and never in
the core Tor network software.

> 
> 	plus, schneier, greenwald and partners don't seem to have too much
> credibility at this point
> 

Why is that?

All the best,
Jacob




From rysiek at hackerspace.pl  Mon Dec 16 17:30:01 2013
From: rysiek at hackerspace.pl (rysiek)
Date: Tue, 17 Dec 2013 02:30:01 +0100
Subject: Aqua - a high bandwidth anonymity system that resists traffic
 analysis
In-Reply-To: <CAJVRA1T5RkwAA1=Y7TuMrH1+SqFyHLopXMHsquorpZXdtwqqsg@mail.gmail.com>
References: <CAJVRA1T5RkwAA1=Y7TuMrH1+SqFyHLopXMHsquorpZXdtwqqsg@mail.gmail.com>
Message-ID: <1510892.DPo3hhB2I8@lap>

Dnia poniedziałek, 16 grudnia 2013 00:11:42 coderman pisze:
> this seemed to get lost in the hubub over the summer,
> 
> ---
> 
> http://research.microsoft.com/apps/pubs/?id=199302

WUT? Microsoft doing such research? And sharing info on it?..

-- 
Pozdr
rysiek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 316 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/fbfb39c0/attachment.sig>

From rysiek at hackerspace.pl  Mon Dec 16 17:38:13 2013
From: rysiek at hackerspace.pl (rysiek)
Date: Tue, 17 Dec 2013 02:38:13 +0100
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
 <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
Message-ID: <1390263.IAfH59sb6t@lap>

Dnia poniedziałek, 16 grudnia 2013 10:00:05 Cari Machet pisze:
> tonight in the us of agh  on 60 minutes they had on a giant ad for the NSA
> 
> fr what i understand alexander has his office set up as star trek battleship
> 
> and this was really weird they do standing meetings with a blue light on
> where he gets a report read to him - they gave the appearance of children
> playing a game

They *are* children playing a game. Boys with (extremely dangerous) toys.

> they said every summer they have high school student interns break code for
> them and they are highly successful
> 
> i just wonder if ppl are thinking about the bio sphere at all in terms of
> some sort of 'encryption' method i mean if we can work outside of the
> little box they have made for themselves (and us) then  mayb things r
> movable?

I think that making working for NSA "srsly uncool, dude" is a very effective 
tactic, for example. Especially in the light of the "thanksgiving talking 
points".

-- 
Pozdr
rysiek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 316 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/6fe8e620/attachment.sig>

From jacob at appelbaum.net  Mon Dec 16 19:03:29 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 17 Dec 2013 03:03:29 +0000
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <52AFAC5F.7000106@appelbaum.net>
 <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>
Message-ID: <52AFBF01.3040608@appelbaum.net>

Juan Garofalo:
> 
> 
> --On Tuesday, December 17, 2013 1:43 AM +0000 Jacob Appelbaum
> <jacob at appelbaum.net> wrote:
> 
>> Juan Garofalo:
>>>
>>>
>>> --On Sunday, December 15, 2013 6:11 PM -0800 coderman
>>> <coderman at gmail.com> wrote:
>>>
>>>> Video:
>>>>  https://archive.org/details/schneier
>>>> Audio:
>>>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_s
>>>>  ch neier/
>>>>
>>>
>>> 	"the nsa can't break tor"
>>>
>>> 	Ha? tor developers admit that the nsa can break tor but schneider says
>>> otherwise? 
>>
>> Where do we admit that the NSA can break Tor? We have seen evidence only
>> for the NSA exploiting the code in Tor Browser (Firefox) and never in
>> the core Tor network software.
> 
> 
> 	See my next messages. I'm referring to the "users get router" paper. 
> 

Wait, you're taking an academic paper, a good one I might add, and
saying that this counts as admission by the Tor Project that our efforts
are futile?

> 	I see no reason to believe that the NSA can't find out who's who in the
> tor network. 

Perhaps the leaked documents that specifically state this fact might
clue you into their capabilities?

I encourage you to read them:

  http://media.encrypted.cc/files/nsa/

Contained in those files, I see no evidence for your assertions. Aaron's
paper is good but as Al said, feel free to show us some evidence that
you've used it to break Tor!

> 
> 	
> 
>>
>>>
>>> 	plus, schneier, greenwald and partners don't seem to have too much
>>> credibility at this point
>>>
>>
>> Why is that?
> 
> 
> 	Because they have access to a lot of information they are not publishing,
> and have close ties to the establishment. 

Wait, they have access to information, that they publish, story by story
and that means that they're not credible? That is hilariously strange
reasoning. The information is coming out as quickly as people are able
to make sense of it.

> 
> 	Plus, isn't the latest news that greenwald was bribed/bought by ebays
> owner, who happens to be the typical fake american 'libertarian' (he's
> actually a mercantilist conservative - see what kind of 'free' market ebay
> is)

No, the latest news is that Glenn still has nouns of steel and is still
publishing incredible news on a regular basis.

All the best,
Jacob




From grarpamp at gmail.com  Tue Dec 17 02:01:53 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 17 Dec 2013 05:01:53 -0500
Subject: [Cryptography] Fwd: [IP] 'We cannot trust' Intel and Via's
 chip-based crypto, FreeBSD developers say
In-Reply-To: <52B002C9.5020604@iang.org>
References: <E871618D-B334-4C34-963F-9B1D88A3DDC4@warpspeed.com>
 <227BEBDF-7DDF-4CE2-92E8-F6D3CF274E58@gmail.com>
 <CANog7L5KN+Kn3OOBW8BXZTw6pR0x4VEfCjxYq7OeB5sv=aui8w@mail.gmail.com>
 <86CC5021-CF61-4F42-83F3-C7CBC741C414@gmail.com>
 <52ABFF68.9010000@iang.org>
 <27375845-384D-40F8-B1FB-C880C27F9A2B@gmail.com>
 <52B002C9.5020604@iang.org>
Message-ID: <CAD2Ti28nbqK+WahS6+oQ7qrGE7DdtoP8-cEHGtSqrcidwEHuSw@mail.gmail.com>

> They want this, if it can be made to work, and they'll try
> it if they don't know.  That's what they said in the goals revelations, and
> I believe them.

This probably can't be mentioned enough. Millions to billions
of gates on a die, lots of room there. Multiplied out to the
millions to billions of computers in service. That's a huge
opportunity no one in their right mind wouldn't try to exploit.
And RNG's are an easy place to do it. RNG is not a box
you can input 2+2 test vector from the outside and get 4
back out. The RNG may even look random, pass diehard, etc.
But if there's a secret seed buried in the RNG somewhere,
you're screwed. And when was the last time anyone ever publicly
decapped and validated a current Intel RNG CPU? <silence>
Sure, mix it in with at least one other source, or shutdown, and
use that. But don't ever use it raw. Embedded RNG's help make
the market for external discrete logic RNG dongles.




From joe_wang at yahoo.com  Tue Dec 17 05:03:23 2013
From: joe_wang at yahoo.com (Joe Wang)
Date: Tue, 17 Dec 2013 05:03:23 -0800 (PST)
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: <52B0405A.3000000@echeque.com>
Message-ID: <1387285403.68404.YahooMailAndroidMobile@web160703.mail.bf1.yahoo.com>

Obama probably didn't pay its developers enough to get solid coders.  Hence a scrappy web system.

Sent from Yahoo Mail on Android

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2941 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/f2bd70b8/attachment.txt>

From s at ctrlc.hu  Tue Dec 17 02:06:11 2013
From: s at ctrlc.hu (stef)
Date: Tue, 17 Dec 2013 11:06:11 +0100
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <52AFC940.8010100@echeque.com>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
 <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
 <1390263.IAfH59sb6t@lap> <52AFC940.8010100@echeque.com>
Message-ID: <20131217100611.GK7149@ctrlc.hu>

On Tue, Dec 17, 2013 at 01:47:12PM +1000, James A. Donald wrote:
> On 2013-12-17 11:38, rysiek wrote:
> >I think that making working for NSA "srsly uncool, dude" is a very effective
> >tactic, for example. Especially in the light of the "thanksgiving talking
> >points".
> 
> Will never work.  You overrate social pressure.

despite german government seemingly having serious problems recruiting
competent devs for producing their own malware and thus being forced to
procure this from front companies of allied agencies. in germany either moral
standards are higher and/or social pressure does work?

-- 
pgp: https://www.ctrlc.hu/~stef/stef.gpg
pgp fp: FD52 DABD 5224 7F9C 63C6  3C12 FC97 D29F CA05 57EF
otr fp: https://www.ctrlc.hu/~stef/otr.txt




From stevens at mpi-sws.org  Tue Dec 17 02:30:44 2013
From: stevens at mpi-sws.org (Stevens)
Date: Tue, 17 Dec 2013 11:30:44 +0100
Subject: Aqua - a high bandwidth anonymity system that resists traffic
 analysis
Message-ID: <52B027D4.2060301@mpi-sws.org>


Hi all,

As the project lead, allow me to clarify. Aqua is not led by Microsoft
Research but by the Max Planck Institute, a publicly funded German
institute for basic research*. The only author affiliated with Microsoft
is Hitesh Ballani, whose expertise on IP anycast has been useful when we
considered using IP spoofing among the mixes (this mechanism is
currently not part of Aqua's design).

All the best,
Stevens

* http://www.mpi-sws.org/index.php

On Tue, Dec 17, 2013 at 4:39 AM, Andy Isaacson <adi at hexapodia.org> wrote:
> On Mon, Dec 16, 2013 at 07:30:50PM -0800, coderman wrote:
>> On Mon, Dec 16, 2013 at 5:30 PM, rysiek <rysiek at hackerspace.pl> wrote:
>> > WUT? Microsoft doing such research? And sharing info on it?..
>>
>> i had this same reaction when i found their Link Quality Source
>> Routing mesh protocol research[0].  crazy times! ;)
>>
>> 0. "Self Organizing Wireless Mesh Networks"
>>   http://research.microsoft.com/en-us/projects/mesh/
>
> MS Research is trying fairly hard to be a Real Research Lab in the vein
> of DEC SRC, Xerox PARC, IBM Almaden.  They released a NetBSD kernel for
> their experimental CPU a few years back.
>
>
http://research.microsoft.com/en-us/downloads/754fee75-c5a0-4542-bf9b-47f236c0a90b/
>
> Strange days we live in.
>
> -andy


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 900 bytes
Desc: OpenPGP digital signature
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/2ca84f32/attachment.sig>

From albill at openbuddha.com  Tue Dec 17 11:31:44 2013
From: albill at openbuddha.com (Al Billings)
Date: Tue, 17 Dec 2013 11:31:44 -0800
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis"
 performed by Stewart Baker
In-Reply-To: <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>
References: <20131217050832.BDD772280D1@palinka.tinho.net>
 <52B092D8.9030706@appelbaum.net>
 <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>
Message-ID: <etPan.52b0a6a0.238e1f29.1ca@Al-Retina.local>

aka “I’m jealous that you have all the data and don’t care if anyone gets hurt by it being dumped unredacted on the net.”

You realize that there are likely things hidden in the data that can get people killed. I know first hand, from a friend who *did* have their data in the wikileaks dump, that at least one of their informants only escaped being killed after it was unveiled because of family connections in the corrupt little nation they were in. 

I hear a lot of sour grapes and jealousy from a few people of “How dare Greenwald not give *me* access to all this data?!?!"

From: John Young John Young
Reply: John Young jya at pipeline.com
Date: December 17, 2013 at 11:26:05 AM
To: cypherpunks at cpunks.org cypherpunks at cpunks.org
Subject:  Re: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed by Stewart Baker  
How about an unfettered unredacted disclosure for unlimited 
access free of censorious redaction and withholding? 
-- 
Al Billings
http://makehacklearn.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3884 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/7e1c7a8e/attachment.txt>

From stephan.neuhaus at tik.ee.ethz.ch  Tue Dec 17 02:53:06 2013
From: stephan.neuhaus at tik.ee.ethz.ch (Stephan Neuhaus)
Date: Tue, 17 Dec 2013 11:53:06 +0100
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <20131217100611.GK7149@ctrlc.hu>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
 <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
 <1390263.IAfH59sb6t@lap> <52AFC940.8010100@echeque.com>
 <20131217100611.GK7149@ctrlc.hu>
Message-ID: <52B02D12.1040308@tik.ee.ethz.ch>

On 2013-12-17, 11:06, stef wrote:
> despite german government seemingly having serious problems
> recruiting competent devs for producing their own malware and thus
> being forced to procure this from front companies of allied agencies.
> in germany either moral standards are higher and/or social pressure
> does work?

I think that this cannot be used in evidence. The plain fact is that the
German government will pay only a fraction of what a company would pay.
 As an example (even though not one that could be applied to a job with
the federal government as a civil servant, but which I nevertheless
believe to be comparable), a PhD being paid according to the pay grade
known as TVöD 14 Step 1 will take home a base salary of roughly 1700
Euros, after taxes.  Also, prospects for promotion are slim and the
bureaucracy is terrible and cannot be evaded.

Best,

Stephan




From electromagnetize at gmail.com  Tue Dec 17 11:02:27 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 17 Dec 2013 13:02:27 -0600
Subject: corektion (re:c4-r3kN.txt (urls))
Message-ID: <CADhsnxcsZS7RwJK+ar0DHDoTX9D_qkU4D6WB1SjkKAr5CKbK3Q@mail.gmail.com>

additional correction/repair of perspective anomalies and errors...

> ../correction_regarding; = "last {urls} list", a needed clarification
> about applied concrete, its also massive and important role in
> reconceptualization. bridges, hi-ways, skyscrapers along with steel,
> office parks via CMUs. innovative material- and form-based aesthetics
> (its own language or dialect, syntax, grammar, etc). medium for ideas,
> shapes ideas, opens up new areas for development & interpretation.
> (note: basis for approach of Le Corbusier (aka 'the crow'),
> structure/order- 'organizational logic' as parti; and FLlW use of
> concrete masonry units and precast concrete as vital to new ideas).
> yet architecture is still much more than these things, it remains a
> detail, sometimes of major significance other times not in the 'ideas'
> involved. sometimes innovative, etc. yet in a larger context or
> situation, larger goals and functioning than just concrete itself,
> alone, as the variable. in other words 'the ideas of architecture' are
> not containable just within concrete, though it can and does have
> major influence at certain stages and within specific approaches. its
> conceptual innovation feeds into architecture and vice-versa,
> symbiotic, including conceptual stagnation due to loss of larger
> vision (ideas) and greater purpose at scales involved due to
> narrowed_focus(), etc(etc).

######################################################################

.// further CORRECTION: once again clarification is needed regarding a
previous statement. this is both due to my own limits in
conceptualization and writing and also problems of language, when it
is extremely difficult to encompass all possible cases in a general
view without having contradictions. in my latest errored statement,
the mistaken view is quite large and so must be countered with more
information. i do not have the particular language nor have i
developed the understanding or framework for these dynamics as of yet,
so wrote into a realm or beyond a structure already developed and thus
encountering significant failures in approach. i.e. stating that
'concrete is only a detail' in architecture. the problem is that this
is not true in some situations, and also the word/concept 'detail' is
not the correct word for what i am trying to describe though i am not
sure what a better word would be, feature or substructure or element
or component or structure yet none of these likewise fit either.
though of course there are many who could better state the same ideas
within an improved POV with more accuracy and much more insight and
more knowledge of the issues involved.

so my approach is limited. the language also. and i equate it to is
the following mistaken viewpoint about concrete in architecture, in
special cases:  it is to assume that the sand is only a detail of the
beach. and this is largely false. it _is the beach, or a major or
significant element along with sky and water and wind and waves. it is
a major component, not minor.

and yet in most architecture the concrete involved does not take
center stage, it is another component, so it tends towards a larger
assemblage of components functioning together and is not the main
event. many times concrete is dressed by other facing materials,
skins, that shield it from the weather and provide a different facade
than CMU or precast panels and yet there are also buildings that are
just CMUs and precast walls and-or floors/ceilings. though their
significance in terms of the total building may still remain that of a
quasi-detail or more minor component or insignificant beyond just
being a barrier or boundary, such that the language may not be
explored or developed or insightful and may have inert presence, such
that it is more about 'nothing' than 'being'. say an industrial
warehouse with no windows and a simple door on an exterior that is
otherwise all concrete, with a company logo as sign.

perhaps this is not just a detail though it is also not going beyond
certain dimensionality in its functioning, it is basic and not
necessarily interwoven into other themes beyond utility, such that it
provides structure or boundary, security, enclosure, perhaps texture,
color, scale. it may be unwise to compare it straight away with a CPU
enclosure, as it relates to what is inside the box, though to some
extent this can be a disconnection or simple boundary that is already
defined in its functioning in many ways, by default, unless explored
further. and thus building is often differentiated from architecture
as it does not have this additional layer or level of investigation,
inquiry, innovation, questioning of parameters, function, beyond this.

so in some sense it is a big SIN to not have remembered epic examples
to the contrary where concrete cannot be said to be just another
element or, again wrong-worded, only a detail, as this warps its
contribution and conceptual potential that has been explored (most
notably by Le Corbusier and others). a few examples to provide
counterpoint...

Notre Dame du Haut
http://en.wikipedia.org/wiki/Notre_Dame_du_Haut

[images] https://www.google.com/search?q=Notre+Dame+du+Haut&client=firefox-a&hs=cqz&rls=org.mozilla:en-US:official&source=lnms&tbm=isch

this chapel by Le Corbusier located in Ronchamp, France, is singularly
in concrete, it defied the existing conceptualization of how the
material could be used and likely still does. it is the determiner of
many architectural dimensions, space, massing, light, enclosure,
walls/ceiling, roof, and if memory serves the massive roof appears to
float when inside, even though made of massive concrete. thus the
gravity of the material has been reverse or inverted. this is the
height of aesthetic mastery, the language of architecture through the
medium of concrete. and more, the use of a ship analogy and metaphor,
its significance in architecture, rendered in concrete as the roof. it
is assumed also medieval fortifications which used to have walls of
several feet thick were related to concrete thickness, when such walls
were once foundation and required to be this thick, which continued
into tall buildings such as skyscrapers when supporting several floors
above them, prior to steel and concrete construction. so perhaps those
(correctly stated) details of windows refer to that earlier language
or pattern. further, there was innovation with formwork such that
textures on the formwork would transfer onto the set concrete forms,
thus revealing wood on its surface, as part of a new technique that
was developed by Le Corbusier. and so this refutes any notion of
concrete only as detail. it is the defining feature across many
dimensions and structures, it almost singularly defines the building
beyond its stained glass and wooden pews. completely captivating in
its essence, and this essence is concrete. and it is a deep
connection, deep awareness, grounding within the material as it is
made into form and functions within a myriad of different parameters.

(also, this built organic form (1954) in relation to sculpture...)

Brancusi sculpture Bird in Space (1930-40) or other
http://www.guggenheim.org/new-york/collections/collection-online/artwork/669


consider then another structure...

Sydney Opera House
http://en.wikipedia.org/wiki/Sydney_Opera_House

it is iconic for its form, resembling billowing sails made of precast
concrete. having visited neither of these structures, it appears
likewise a majority of the building exterior consists of precast
concrete panels. thus another example that 'concrete is not just a
detail', which in these cases is an absurd and ignorant viewpoint,
when universalized. it is the major or prime structural component
though also the basis for conceptualization, the medium that is relied
upon and explored to express or develop such a unique language of
form, based upon the specific and unique properties of concrete in its
various techniques and approaches, many of which are invented by
architects for buildings and have never been built before. thus this
is a realm of large-scale experimentation, the limits of construction,
and daring work even.

it should be noted that recently i encountered a reference to this
building which said how beautiful it was on the outside as a concert
hall, yet the acoustics on the inside are or were horrible, and thus
the building aesthetics and its interior programmatic functionality
were not matched- though this is also why acoustic engineering exists,
which can often optimize a space in such scenarios. the difference
here is that buildings in the past, when having a main function like
'music hall' or 'opera house' were designed around acoustic properties
firstly, if not mistaken. and this is not about chance, how sound
exists in a given space in terms of its size, shape, proportion,
materiality, etc. and thus the outside-in approach, versus inside-out
approach, and how this can conflict perhaps most especially in terms
of the present day where 'image-based' buildings have their external
form as the main development or feature and functionality is presumed
to default to a usable correlated equivalency, yet can also be
hollowed out of meaning, superficial, merely about the surface and not
insightful in other realms or other substructures or components. a bit
like a building that is masquerading, and appears one way yet under
the mask is another way. like fancy aesthetic structures that are
miserable to be inside or just mediocre, yet praised for their looks
or drama, yet less livable or even dysfunctional or needy, requiring
high-maintenance, concessions by its occupants, which is its own type
of lost economy or friction that indicates peculiar approaches,
values.
--
it is hard to convey how central aesthetics are to knowledge yet when
removed of its role as a grounding of philosophy, of shared belief and
truth, values, knowledge, as materialized, it then can become detached
and move into a realm of relativistic babble, greater accounting does
not take place, and images can be deceiving, illusion or manipulations
of the senses.

another realm of 'concrete is more than detail' it is
conceptualization itself is within the realm of Brutalism, a
particular movement or style in architecture...

Brutalist architecture
http://en.wikipedia.org/wiki/Brutalist_architecture

as should be obvious, my observations are only limited and there are
people with vast understanding who have researched these issues and
who have expertise, though some of this also is intuitive, from living
in civilization and environments where such buildings exist and define
a space, within given parameters. and I have a fondness for a local
example, at least in its appearance, which tends towards fortification
though has also been evaluated as a response to student unrest on
college campuses, an embodiment of the fortification of the
educational system against students and populations, visible in
aesthetics of built form.

Boston City Hall
http://en.wikipedia.org/wiki/Boston_City_Hall

so in the history books i read that defined a particular shared
consciosuness, this building is one of the main examples. and it is
implicitly 'concrete' in more than detail, it is seemingly in its
conceptual entirety, in that it melds what is material also with the
mental awareness of concrete as metaphor or analogy, as if anchoring
something into the ground, making an idea it into a tangible truth,
via securing of spatial-order vis a vis security or fortress, or
whatever. in that an underlying realm of hostility and unrest or a
different mapping of experience may better be realized or understood
in these more stark forms and encounters, as if the realm of
ubiquitous surveillence maps more readily into these aesthetics even,
then those buildings of high gloss, shiny distracting objects. in
other words, you could probably use this building for military
purposes even, or some such structures, because of their more
fortified nature than all-glass facades, and a more primal or
primitive relation could be established, more natural perhaps with the
social Darwinist/Spencerian survival of the fittest dynamics, if not
even towards a Planet of the Apes retro-futurism of some kind. again,
concrete here is more than the material, it is a larger connected
essence and its language is developed in depth.

Rarig Center for performing arts at U of Minnesota (local example)
https://www.google.com/search?q=rarig+center&client=firefox-a&hs=Ixf&rls=org.mozilla:en-US:official&source=lnms&tbm=isch

so there is a difference in how a medium develops, in what terms and
parameters, what ideas are explored and what conceptualization is
involved. it can be contained, and thus a material could exist only as
a detail in some or many circumstances, yet in others it could become
a major or main event and take on a primary role, and become a realm
of peak inquiry and innovation. this both in terms of language and
geometry/mathematics, of structures and aesthetics, as it relates to
concepts, patterns. or it could be unquestioned and an issue of
utility, relied upon to do once again what has been provably done
before within given parameters. yet to describe all of this dynamic
range within linear strings is impossible and arbitrary, because it is
far more involved, and requires clarification for each and every error
or misconception and thus words words words to seek to repair faulty
frameworks and reasoning that is limited, bounded, to particular
constraints or points of views, etc. and thus this condition of
language could itself be the gap or mismatch with the issues of
existence, the impossibility of accurately relating to what is going
on in its ubiquity and depth within the parameters it exists within,
without being trapped in warped, distorted, and biased if not untrue
or only partially-true statements that then function as communication,
frameworks.

there appears no way to fix this within linear language itself. this
as it relates to code and to programming likewise. it is a trap, ideas
and concepts cannot be empirically developed within words to a degree
of fidelity required to attain 1:1 conceptual models. thus, also,
software ever disconnected from what it seeks to represent in these
same scenarios.

it is the artificial and misleading, false 'nature of things', this
language-based communication about events and seeking to model events
within signs that are linearly described, looped, versus within
molecular dimensional structures - circuits - that can actually
account for all components, elements, details and events in whatever
degree and fidelity they may exist.

one stray example arises repeatedly in my mind about the nature of
architecture as it has become detached from a larger accounting and as
this relates to core principles. it used to be a goal to have a
structure last, to endure over time, as part of the goal. today
instead planned obsolence has taken hold so buildings may stand for
only 30 years before being demolished. consider this in terms of how
it influences design, what issues are addressed and ignored, and how
much material is wasted to continue such an inefficent process that
also stands-in for development as an engine, process, or flow of
activity that circulates money around. in that it is a circuit, how
this functions.

no doubt there is aesthetic beauty in many buildings though what it
often hides is that other issues are being ignored (such as
environment, planning, social relations) and architecture can just be
about the image. perhaps like those apps that can be easily created by
putting various parts together, throwing an interface on a given
structure, yet that is not innovating beyond a particular level of
inquiry or set of relations, which then become bounded, limiting.

the following observation is not to question the legitimacy of
approach for the building in its functioning, which is built like
others by star architects all around the globe. so it is not to single
it out as an example, though it provides a case in point regarding
certain values that are taught of in school that in practice are
seemingly no longer of significant importance...

consider the birds nest stadium built for the 2008 Summer Olympics...

Beijing National Stadium
http://en.wikipedia.org/wiki/Beijing_National_Stadium

while of great beauty, there is also great dismay at the material
design involved due to issues of economy. in school they teach you of
surface area, how this relates to heating and cooling of a structure,
and how each and every joint or connection is a potential weakness,
whether for water or rust or expansion/contraction failures from
stress and strain, including between different or particular
materials. how a building is put together and funcdtions over time.
that this is part of its success or failure.

and my immediate thought or reaction really upon seeing this 'visual
structure' was the known extreme maintenance it would require over
time, in having to maintain/upkeep the 'visual structure' via
presumably paint and-or rust protection, for each angled connection
and joint and surface. perhaps it will not rust, perhaps it requires
no painting. yet if it does it is certainly non-trivial as to the way
the building functions over time. unless like most stadiums these
days, it is destroyed after 30 years time.

(in some way the detachment from larger considerations allows this
narrow 'design development' to take place in architecture, it is in
some significant way a form of luxury, yet detached from
responsibility, afforded by ignoring other vital aspects, decadent or
based in excess, disregard for economy beyond economics, as if
architecture is financialization writ large even. the embodiment of a
business philosophy detached from the surface of the earth in its
actual truthful accounting and functioning instead within parameters
of a fairy tale that is never spoken against, to sustain the illusion
or delusion that aesthetics can be primary without also securing their
foundation, connecting it with deeper truth. instead it can be
shallow, hollow, or unsteady, and may not withstand the momentums of
culture as it continues to advance or stall out over time. there is
something of a treachery involved in 'image-analysis' that lacks a
larger framework for its evaluation, and yet this has become the
guiding 'philosophy' of architecture likewise, to which students must
kneel down before such ideas as if of superior nature and awareness
versus cutting corners and in effect, cheating the discipline of its
integrity and substituting it with a lesser set of goals and ideals
that tend towards the profane instead.)

in some ways it seems that code can be like this also. that there can
be structures that are difficult to maintain or upkeep yet are
developed in a way that there is no way to sustain them over time.
tens of millions of lines of code say, that cannot simply be renovated
or simply tweaked or fixed up. it appears almost as if a prevailing
ethos of development both online and offline, in software, hardware,
and material development, processes and procedures as this maps to
business, social relations, and how knowledge exists and moves into a
particular direction, as if a kind of momentum or flow within a given
circuit whose parameters best or most optimally function in this way,
yet may not add up to more over time, and more require a limited or
bounded relation or condition for their existence. in that this
interaction or limited engagement is the nature of the material so
conceived, considered and that another system or material approach may
be required to develop other options that are not preconceived or
pre-wired into the existing approaches and "economical" methods that
can lack the foundation needed to develop cohension in other areas,
shared realms of inquiry, larger modeling or conceptualization beyond
the finite, separate, iconic isolation that becomes based and reliant
upon principles that may function against larger, longer goals, simply
by using existing approaches that have ideological functioning
built-in.

######################################################################

niner  double  exo




From jamesd at echeque.com  Mon Dec 16 19:47:12 2013
From: jamesd at echeque.com (James A. Donald)
Date: Tue, 17 Dec 2013 13:47:12 +1000
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <1390263.IAfH59sb6t@lap>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
 <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
 <1390263.IAfH59sb6t@lap>
Message-ID: <52AFC940.8010100@echeque.com>

On 2013-12-17 11:38, rysiek wrote:
> I think that making working for NSA "srsly uncool, dude" is a very effective
> tactic, for example. Especially in the light of the "thanksgiving talking
> points".

Will never work.  You overrate social pressure.  Social pressure does 
not work on most males, and does not work on females under the influence 
of a bad boy alpha male.

Would nazism be cool 
http://www.nydailynews.comentertainment/gossip/tila-tequila-wears-nazi-uniform-praises-hitler-shocking-rant-article-1.1543467 
if the winners had not made it the incarnation of evil?

The commies killed way more people than the nazis, but no one ever 
dresses up as commissar and kulak to perform sexual acts.

If the Nazis had won instead of the commies, and the Wikipedia articles 
on communism read the way the articles on Nazism read in our reality, if 
Senator McCarthy got in trouble for complaining about Nazis in the state 
department, if employees routinely get fired for using words suggestive 
of thoughts suggestive of class conflict, and every television villain 
is of an evil race, rather than a white male ceo, then commissars would 
be sexy.

But, in our reality, despite not stop television demonization, or rather 
because of it, white male CEOs and nazi stormtroopers are sexy.

You think social pressure works, because people stop using certain words 
for homosexual, and call firemen firefighters, but that is not social 
pressure, that is because employers fire people who use those words, and 
if they don't fire them, the government runs the employer out of 
business - not soft power, but hard power thinly dressed as soft power.



>




From jya at pipeline.com  Tue Dec 17 11:09:59 2013
From: jya at pipeline.com (John Young)
Date: Tue, 17 Dec 2013 14:09:59 -0500
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis"
 performed by Stewart Baker
In-Reply-To: <52B092D8.9030706@appelbaum.net>
References: <20131217050832.BDD772280D1@palinka.tinho.net>
 <52B092D8.9030706@appelbaum.net>
Message-ID: <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>

A good point, Jake. That status quo of commercial journalism.

What's better than advocacy journalism subservience?

How about an unfettered unredacted disclosure for unlimited
access free of censorious redaction and withholding?

And giving up the "dump" red herring, WikiLeaks is unfairly
accused of that, and has been considerably more various,
experimental and risk-taking than professional journalism.
It would do well to give up the privileged protection of
journalism which demeans its reputation.

Exceptions to the cowardice of journalism abound, but have
to be found so little are they known and credited beyond naming
awards, and they defy the presumed status quo of what is
permissable lawful and craven. Yes, many went to jail rather
than bray about the jailing of others, reaping the rewards of
consulting with authorities to maintain access.

Hoped you had nutted Stew Baker, a lying sack of shit.


At 01:07 PM 12/17/2013, you wrote:
>dan at geer.org:
> > all
> > journalism is now advocacy journalism;
>
>All journalism is and has always been "advocacy" journalism. Often
>people don't notice the so-called advocacy as it is usually for the
>unjust status quo in an unquestioning, fully compromising subservient
>manner, I'd add.
>
>All the best,
>Jacob





From jya at pipeline.com  Tue Dec 17 11:20:25 2013
From: jya at pipeline.com (John Young)
Date: Tue, 17 Dec 2013 14:20:25 -0500
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <52B0961C.3040508@appelbaum.net>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <52AFAC5F.7000106@appelbaum.net>
 <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>
 <52AFBF01.3040608@appelbaum.net>
 <6F4CEC544340D54F1C1A002E@F74D39FA044AA309EAEA14B9>
 <52B0961C.3040508@appelbaum.net>
Message-ID: <E1Vt0Bb-0000bm-JP@elasmtp-banded.atl.sa.earthlink.net>

You understand I am Juan, Jon, Ian, Ivan, Giovanni and
Jean. And Julian and Ed and Chelsea. Chinese, Russian,
Iranian and terrorist. All undifferentiated in a haystack of
PRISM and drone demons.

Hurling insults aid finding the easiest to turn or burn.



At 01:21 PM 12/17/2013, you wrote:
>Juan Garofalo:
> >
> >
> > --On Tuesday, December 17, 2013 3:03 AM +0000 Jacob Appelbaum
> > <jacob at appelbaum.net> wrote:
> >
> >> Juan Garofalo:
> >>>
> >>>
> >>> --On Tuesday, December 17, 2013 1:43 AM +0000 Jacob Appelbaum
> >>> <jacob at appelbaum.net> wrote:
> >>>
> >>>> Juan Garofalo:
> >>>>>
> >>>>>
> >>>>> --On Sunday, December 15, 2013 6:11 PM -0800 coderman
> >>>>> <coderman at gmail.com> wrote:
> >>>>>
> >>>>>> Video:
> >>>>>>  https://archive.org/details/schneier
> >>>>>> Audio:
> >>>>>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce
> >>>>>>  _s ch neier/
> >>>>>>
> >>>>>
> >>>>>   "the nsa can't break tor"
> >>>>>
> >>>>>   Ha? tor developers admit that the nsa can break tor but 
> schneider says
> >>>>> otherwise?
> >>>>
> >>>> Where do we admit that the NSA can break Tor? We have seen evidence only
> >>>> for the NSA exploiting the code in Tor Browser (Firefox) and never in
> >>>> the core Tor network software.
> >>>
> >>>
> >>>     See my next messages. I'm referring to the "users get router" paper.
> >>>
> >>
> >> Wait, you're taking an academic paper, a good one I might add, and
> >> saying that this counts as admission by the Tor Project that our efforts
> >> are futile?
> >
> >
> >       The paper states that traffic analysis is feasible. I mean, 
> that isn't
> > exactly news. The paper seems to admit that traffic analysis is (a lot?)
> > easier that previously supposed.
> >
>
>Traffic analysis is likely feasible if you can watch all of the
>internet. The question is at what resolution? With full packet captures
>of everything, for all time, it becomes a statistical question with some
>possibly negative outcomes.
>
> >       So, yes, that shows that tor can't protect people from the 
> US government.
>
>Actually, we see from the documents that they cannot deanonymize all
>people, all of the time; they must target. So actually, it *does*
>protect people from instantly falling into the pitfalls related to
>dragnet surveillance. You're avoiding this and it is totally silly.
>
> > Which actually shouldn't be surprising since tor is a tool of the US
> > government.
>
>The Tor Project is a 501c3 non-profit. As a company, we're not tools of
>anyone and as a tool, tor, is similarly not a tool of the US government.
>Your statements indicating otherwise are just rude and uninformed.
>
> >
> >       As to your 'efforts being futile' - that's not my wording. 
> Depending on
> > what your ends are, your efforts are certainly not futile...
> >
>
>Could you possibly be more of an asshole, Juan?
>
> >
> >
> >>
> >>>     I see no reason to believe that the NSA can't find out 
> who's who in the
> >>> tor network.
> >>
> >> Perhaps the leaked documents that specifically state this fact might
> >> clue you into their capabilities?
> >
> >
> >       Oh, come on. Again "absence of evidence is not evidence of absence".
> >
>
>How does that old quote go? "That which is presented without evidence
>may be dismissed without argument." Yeah, exactly.
>
> >>
> >> I encourage you to read them:
> >>
> >>   http://media.encrypted.cc/files/nsa/
> >
> >       I've already seen a few of them. No, I obviously don't 
> think that those
> > prove anything. Did I mention that "absence of evidence is not evidence of
> > absence"?
>
>
>The NSA and the GCHQ ran a real operation to deanonymize someone. Do you
>understand how they attempted to do this? Do you understand the evidence
>presented or will you continue to ignore it?
>
> >
> >       And while we're it, did I miss any leaked documents 
> discussing traffic
> > analysis of tor? There should be some no?
>
>Yes, you did - read the above documents already? The CES summer school
>document discusses some of this and it is sadly very poor research. The
>open community, such as Aaron's recent paper, is much much further
>ahead. This is what we expect - this is why we work with an open
>research community so seriously.
>
> >
> >>
> >> Contained in those files, I see no evidence for your assertions. Aaron's
> >> paper is good but as Al said, feel free to show us some evidence that
> >> you've used it to break Tor!
> >
> >
> >       I really can't believe you wrote that. You think I'm that stupid?
>
>I'm giving you some credit - break it, already?
>
> >
> >       The way to 'break' tor, that is, find things like the 
> location of, say,
> > freedom hosting and silk road, is to monitor traffic. I obviously can't do
> > that. Your government can obviously do that.
> >
>
>Can you please explain to everyone how they found the location of the
>Silk Road? Hint: it wasn't Tor, it was his extremely bad operational
>security and using... a VPN!
>
> >       Please.
> >
> >>
> >>>
> >>>
> >>>
> >>>>
> >>>>>
> >>>>>   plus, schneier, greenwald and partners don't seem to have too much
> >>>>> credibility at this point
> >>>>>
> >>>>
> >>>> Why is that?
> >>>
> >>>
> >>>     Because they have access to a lot of information they are not
> >>>     publishing, and have close ties to the establishment.
> >>
> >> Wait, they have access to information, that they publish, story by story
> >> and that means that they're not credible? That is hilariously strange
> >> reasoning.
> >
> >
> >       What's hilarious is your attempt at twisting what I said.
> >
>
>You criticize the only people working to inform the public and you
>degrade their honor without having real information about their
>specifics. Do you live under threat for your work? Do you live in exile
>from your home country? Do you do anything that matters where someone
>else has some criticisms because they don't have a full view on your
>entire life or because they misunderstand something about what is
>presented in public?
>
> >
> >> The information is coming out as quickly as people are able
> >> to make sense of it.
> >
> >
> >       Oh really. I need to be spoon fed by computer illiterate 
> greenwald? That's
> > cool...
> >
> >       And how do these superior people gauge the rate at which the inferior
> > people they spoon fed are able to consume what they are given? Just
> > curious...
> >
>
>Ah, I see - you're basically just green with envy? Well, get in line, eh?
>
> >
> >
> >>
> >>>
> >>>     Plus, isn't the latest news that greenwald was bribed/bought by ebays
> >>> owner, who happens to be the typical fake american 'libertarian' (he's
> >>> actually a mercantilist conservative - see what kind of 'free' market
> >>> ebay is)
> >>
> >> No, the latest news is that Glenn still has nouns of steel and is still
> >> publishing incredible news on a regular basis.
> >
> >
> >       OK...
> >
>
>You could actually demonstrate that you see that Glenn, Laura and others
>have taken real risks by doing anything at all to inform us. The way
>that you behave, it is a wonder that they take such risks with people
>who are so cynical and ungrateful as their peanut gallery. Lucky for the
>rest of humanity that for every dozen people spending their energy being
>so unkind, as you are, we have thousands who appreciate their efforts.
>
>All the best,
>Jacob





From coderman at gmail.com  Tue Dec 17 14:22:48 2013
From: coderman at gmail.com (coderman)
Date: Tue, 17 Dec 2013 14:22:48 -0800
Subject: Tor funding [was: ranting at Juan's hatebait rapaciously [before
 that, something about: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet]]
Message-ID: <CAJVRA1Q0hKHX1YxqWumBNVFPMv-odpq2DvKwkKRt+YyxhoQ1QQ@mail.gmail.com>

On Mon, Dec 16, 2013 at 12:27 AM, coderman <coderman at gmail.com> wrote:
> ...
> b) you insist Tor's origins and funding sources are proof of
> malfeasance; they've responded by diversifying funding.


even more today :)

https://blog.torproject.org/blog/announcement-tor-project-now-accepting-bitcoin-donations

"""

Over the past year, we have received many requests for us to accept
bitcoin donations. After careful consideration and research, we are
thrilled to announce that effective today The Tor Project is accepting
bitcoin donations. In partnership with Bitpay, bitcoins can easily and
directly be donated to support Tor’s ongoing mission of being the
global resource for privacy technology advocacy, research and
education in the ongoing pursuit of freedom of speech, privacy rights
online, and censorship circumvention. Check out ourdonations page now.
Bitcoin donations received by The Tor Project will be converted
directly to US Dollars.

Our decision to accept bitcoins has been well thought out and
researched from a financial accounting perspective with an eye on
passing our required annual A-133 audit. We believe we are the first
US 501(c)3 non-profit organization to test acceptance of bitcoins and
attempt to pass the US Government A-133 Audit Standard. Our 2013 audit
results, along with our past financial documents, will be made
available on our website once complete in 2014.

The Tor Project is also proud to be in the company of other visible
non-profit organizations accepting bitcoins including EFF and
Wordpress.

Why is this important? The Tor Project needs your donations to
continue our mission and to keep the Tor suite of technologies ahead
with the growing threats to privacy and anonymity around the world.
Your donation made TODAY, through bitcoin, Paypal, Amazon Payments,
Givv.org, checks, money orders or bank transfers, will provide greater
security and privacy for millions around the world who use Tor every
day.

Help us continue our mission!
"""




From coderman at gmail.com  Tue Dec 17 14:46:10 2013
From: coderman at gmail.com (coderman)
Date: Tue, 17 Dec 2013 14:46:10 -0800
Subject: Tor funding [was: ranting at Juan's hatebait rapaciously [before
 that, something about: request for transcript: Bruce Schneier and Eben
 Moglen discuss a post-Snowden Internet]]
In-Reply-To: <52B0D115.5070004@kjro.se>
References: <CAJVRA1Q0hKHX1YxqWumBNVFPMv-odpq2DvKwkKRt+YyxhoQ1QQ@mail.gmail.com>
 <52B0D115.5070004@kjro.se>
Message-ID: <CAJVRA1Sdpe6_Wf_ZCorpXq+Kns93vHiXQFK6495uCh=f6-NHbA@mail.gmail.com>

On Tue, Dec 17, 2013 at 2:32 PM, Kelly John Rose <iam at kjro.se> wrote:
> Funny question, can you donate anonymously with bitcoins?

sort of, but not really.  still waiting on http://zerocoin.org/ ...




From jya at pipeline.com  Tue Dec 17 12:11:06 2013
From: jya at pipeline.com (John Young)
Date: Tue, 17 Dec 2013 15:11:06 -0500
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis"
 performed by Stewart Baker
In-Reply-To: <etPan.52b0a6a0.238e1f29.1ca@Al-Retina.local>
References: <20131217050832.BDD772280D1@palinka.tinho.net>
 <52B092D8.9030706@appelbaum.net>
 <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>
 <etPan.52b0a6a0.238e1f29.1ca@Al-Retina.local>
Message-ID: <E1Vt0yU-0004mb-U3@elasmtp-banded.atl.sa.earthlink.net>

Ongoing debate on whether its better to hide government
informers or expose them. They want to be hidden, their victims
want them exposed. Customarily the victims don't win due to
superior PR of informers and those who pay them.

One case of harm has received attention lately. A lot of
attention, as if an orchestrated campaign in parallel to
the Snowden affair dominated by massive withholdings,
redactions and fragments while claiming large numbers
of files in reserve -- a hoary dissimulation practice of
those complicit with officials.

Beyond that, those who get control of sensitive material
deputize themselves to redact or hide, with appreciation
of authorities, not understanding they are usually less
capable of comsec and judgment than official holders.
They are blinded and corrupted by the bright jewels
suddenly coming their way.

It has been seen that the sensitive material from both
Manning and Snowden was breached rather quickly.
Literally under the noses of the defenders by Lamo
and by Miranda, perhaps others not publicized.

Recipients rush to consult experts as if those experts are
not cooperating with officials covertly under contract or
as informants like Sabu, or are themselves less capable
at comsec and judgment. And also blinded and corrupted
by being consulted about matters only imagined heretofore.

Experts are expert at duplicity one and all.

In the Manning and Snowden cases, recipients were
quickly shown to be unprepared for handling what came
to them, compared to say, reporters, researchers, writers
and scholars who had long experience.

In both cases, the original leakers had unreasonable
expectations that amateurs (we believe in amateurs
over professionals) would rise to the occasion, could
handle the pressure of acclaim and attacks, could
protect the leakers, could manage the information
release, could protect the information, could be
as good as the leakers with much superior training
and discipline.

Not so, under allure of media celebrity the schemes
fell apart for Manning, maybe for Snowden. For this
the leakers had no training only the shallowness of
news reports about who to share the material with.

Even now, the battle goes on, with accusations of
harm to those identified in leaked material by WikiLeaks
shaping the release of Snowden material. Little attention
is given to what failed in handing material to notorious
persons without grasping their limitations and the risks
posed by that.



At 02:31 PM 12/17/2013, you wrote:
>aka “I’m jealous that you have all the data 
>and don’t care if anyone gets hurt by it being 
>dumped unredacted on the net.”
>
>You realize that there are likely things hidden 
>in the data that can get people killed. I know 
>first hand, from a friend who *did* have their 
>data in the wikileaks dump, that at least one of 
>their informants only escaped being killed after 
>it was unveiled because of family connections in 
>the corrupt little nation they were in.
>
>I hear a lot of sour grapes and jealousy from a 
>few people of “How dare Greenwald not give *me* access to all this data?!?!"
>
>
>----------
>From: John Young <mailto:jya at pipeline.com>John Young
>Reply: John Young <mailto:jya at pipeline.com>jya at pipeline.com
>Date: December 17, 2013 at 11:26:05 AM
>To: cypherpunks at cpunks.org 
><mailto:cypherpunks at cpunks.org>cypherpunks at cpunks.org
>Subject:  Re: Fwd: Jacob impervious to "Rubber 
>Hose Cryptanalysis" performed by Stewart Baker
>>How about an unfettered unredacted disclosure for unlimited
>>access free of censorious redaction and withholding?
>--
>Al Billings
>http://makehacklearn.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4134 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131217/259c6bfb/attachment.txt>

From iam at kjro.se  Tue Dec 17 14:32:53 2013
From: iam at kjro.se (Kelly John Rose)
Date: Tue, 17 Dec 2013 17:32:53 -0500
Subject: Tor funding [was: ranting at Juan's hatebait rapaciously [before
 that, something about: request for transcript: Bruce Schneier and Eben
 Moglen discuss a post-Snowden Internet]]
In-Reply-To: <CAJVRA1Q0hKHX1YxqWumBNVFPMv-odpq2DvKwkKRt+YyxhoQ1QQ@mail.gmail.com>
References: <CAJVRA1Q0hKHX1YxqWumBNVFPMv-odpq2DvKwkKRt+YyxhoQ1QQ@mail.gmail.com>
Message-ID: <52B0D115.5070004@kjro.se>

Funny question, can you donate anonymously with bitcoins?

On 12/17/2013 5:22 PM, coderman wrote:
> On Mon, Dec 16, 2013 at 12:27 AM, coderman <coderman at gmail.com> wrote:
>> ...
>> b) you insist Tor's origins and funding sources are proof of
>> malfeasance; they've responded by diversifying funding.
> 
> 
> even more today :)
> 
> https://blog.torproject.org/blog/announcement-tor-project-now-accepting-bitcoin-donations
> 
> """
> 
> Over the past year, we have received many requests for us to accept
> bitcoin donations. After careful consideration and research, we are
> thrilled to announce that effective today The Tor Project is accepting
> bitcoin donations. In partnership with Bitpay, bitcoins can easily and
> directly be donated to support Tor’s ongoing mission of being the
> global resource for privacy technology advocacy, research and
> education in the ongoing pursuit of freedom of speech, privacy rights
> online, and censorship circumvention. Check out ourdonations page now.
> Bitcoin donations received by The Tor Project will be converted
> directly to US Dollars.
> 
> Our decision to accept bitcoins has been well thought out and
> researched from a financial accounting perspective with an eye on
> passing our required annual A-133 audit. We believe we are the first
> US 501(c)3 non-profit organization to test acceptance of bitcoins and
> attempt to pass the US Government A-133 Audit Standard. Our 2013 audit
> results, along with our past financial documents, will be made
> available on our website once complete in 2014.
> 
> The Tor Project is also proud to be in the company of other visible
> non-profit organizations accepting bitcoins including EFF and
> Wordpress.
> 
> Why is this important? The Tor Project needs your donations to
> continue our mission and to keep the Tor suite of technologies ahead
> with the growing threats to privacy and anonymity around the world.
> Your donation made TODAY, through bitcoin, Paypal, Amazon Payments,
> Givv.org, checks, money orders or bank transfers, will provide greater
> security and privacy for millions around the world who use Tor every
> day.
> 
> Help us continue our mission!
> """
> 




From jacob at appelbaum.net  Tue Dec 17 10:07:20 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 17 Dec 2013 18:07:20 +0000
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed
 by Stewart Baker
In-Reply-To: <20131217050832.BDD772280D1@palinka.tinho.net>
References: <20131217050832.BDD772280D1@palinka.tinho.net>
Message-ID: <52B092D8.9030706@appelbaum.net>

dan at geer.org:
> all
> journalism is now advocacy journalism;

All journalism is and has always been "advocacy" journalism. Often
people don't notice the so-called advocacy as it is usually for the
unjust status quo in an unquestioning, fully compromising subservient
manner, I'd add.

All the best,
Jacob




From jacob at appelbaum.net  Tue Dec 17 10:21:16 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 17 Dec 2013 18:21:16 +0000
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <6F4CEC544340D54F1C1A002E@F74D39FA044AA309EAEA14B9>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <52AFAC5F.7000106@appelbaum.net>
 <1F2E328E402C269F4A9CF0E1@F74D39FA044AA309EAEA14B9>
 <52AFBF01.3040608@appelbaum.net>
 <6F4CEC544340D54F1C1A002E@F74D39FA044AA309EAEA14B9>
Message-ID: <52B0961C.3040508@appelbaum.net>

Juan Garofalo:
> 
> 
> --On Tuesday, December 17, 2013 3:03 AM +0000 Jacob Appelbaum
> <jacob at appelbaum.net> wrote:
> 
>> Juan Garofalo:
>>>
>>>
>>> --On Tuesday, December 17, 2013 1:43 AM +0000 Jacob Appelbaum
>>> <jacob at appelbaum.net> wrote:
>>>
>>>> Juan Garofalo:
>>>>>
>>>>>
>>>>> --On Sunday, December 15, 2013 6:11 PM -0800 coderman
>>>>> <coderman at gmail.com> wrote:
>>>>>
>>>>>> Video:
>>>>>>  https://archive.org/details/schneier
>>>>>> Audio:
>>>>>>  http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce
>>>>>>  _s ch neier/
>>>>>>
>>>>>
>>>>> 	"the nsa can't break tor"
>>>>>
>>>>> 	Ha? tor developers admit that the nsa can break tor but schneider says
>>>>> otherwise? 
>>>>
>>>> Where do we admit that the NSA can break Tor? We have seen evidence only
>>>> for the NSA exploiting the code in Tor Browser (Firefox) and never in
>>>> the core Tor network software.
>>>
>>>
>>> 	See my next messages. I'm referring to the "users get router" paper. 
>>>
>>
>> Wait, you're taking an academic paper, a good one I might add, and
>> saying that this counts as admission by the Tor Project that our efforts
>> are futile?
> 
> 
> 	The paper states that traffic analysis is feasible. I mean, that isn't
> exactly news. The paper seems to admit that traffic analysis is (a lot?)
> easier that previously supposed. 
> 

Traffic analysis is likely feasible if you can watch all of the
internet. The question is at what resolution? With full packet captures
of everything, for all time, it becomes a statistical question with some
possibly negative outcomes.

> 	So, yes, that shows that tor can't protect people from the US government.

Actually, we see from the documents that they cannot deanonymize all
people, all of the time; they must target. So actually, it *does*
protect people from instantly falling into the pitfalls related to
dragnet surveillance. You're avoiding this and it is totally silly.

> Which actually shouldn't be surprising since tor is a tool of the US
> government. 

The Tor Project is a 501c3 non-profit. As a company, we're not tools of
anyone and as a tool, tor, is similarly not a tool of the US government.
Your statements indicating otherwise are just rude and uninformed.

> 
> 	As to your 'efforts being futile' - that's not my wording. Depending on
> what your ends are, your efforts are certainly not futile...
> 

Could you possibly be more of an asshole, Juan?

> 
> 
>>
>>> 	I see no reason to believe that the NSA can't find out who's who in the
>>> tor network. 
>>
>> Perhaps the leaked documents that specifically state this fact might
>> clue you into their capabilities?
> 
> 
> 	Oh, come on. Again "absence of evidence is not evidence of absence". 
> 

How does that old quote go? "That which is presented without evidence
may be dismissed without argument." Yeah, exactly.

>>
>> I encourage you to read them:
>>
>>   http://media.encrypted.cc/files/nsa/
> 
> 	I've already seen a few of them. No, I obviously don't think that those
> prove anything. Did I mention that "absence of evidence is not evidence of
> absence"? 


The NSA and the GCHQ ran a real operation to deanonymize someone. Do you
understand how they attempted to do this? Do you understand the evidence
presented or will you continue to ignore it?

> 
> 	And while we're it, did I miss any leaked documents discussing traffic
> analysis of tor? There should be some no?

Yes, you did - read the above documents already? The CES summer school
document discusses some of this and it is sadly very poor research. The
open community, such as Aaron's recent paper, is much much further
ahead. This is what we expect - this is why we work with an open
research community so seriously.

> 
>>
>> Contained in those files, I see no evidence for your assertions. Aaron's
>> paper is good but as Al said, feel free to show us some evidence that
>> you've used it to break Tor!
> 
> 
> 	I really can't believe you wrote that. You think I'm that stupid? 

I'm giving you some credit - break it, already?

> 
> 	The way to 'break' tor, that is, find things like the location of, say,
> freedom hosting and silk road, is to monitor traffic. I obviously can't do
> that. Your government can obviously do that. 
> 

Can you please explain to everyone how they found the location of the
Silk Road? Hint: it wasn't Tor, it was his extremely bad operational
security and using... a VPN!

> 	Please.
> 
>>
>>>
>>> 	
>>>
>>>>
>>>>>
>>>>> 	plus, schneier, greenwald and partners don't seem to have too much
>>>>> credibility at this point
>>>>>
>>>>
>>>> Why is that?
>>>
>>>
>>> 	Because they have access to a lot of information they are not
>>> 	publishing, and have close ties to the establishment. 
>>
>> Wait, they have access to information, that they publish, story by story
>> and that means that they're not credible? That is hilariously strange
>> reasoning. 
> 
> 
> 	What's hilarious is your attempt at twisting what I said. 
> 

You criticize the only people working to inform the public and you
degrade their honor without having real information about their
specifics. Do you live under threat for your work? Do you live in exile
from your home country? Do you do anything that matters where someone
else has some criticisms because they don't have a full view on your
entire life or because they misunderstand something about what is
presented in public?

> 
>> The information is coming out as quickly as people are able
>> to make sense of it.
> 
> 
> 	Oh really. I need to be spoon fed by computer illiterate greenwald? That's
> cool...
> 
> 	And how do these superior people gauge the rate at which the inferior
> people they spoon fed are able to consume what they are given? Just
> curious...
> 

Ah, I see - you're basically just green with envy? Well, get in line, eh?

> 
> 
>>
>>>
>>> 	Plus, isn't the latest news that greenwald was bribed/bought by ebays
>>> owner, who happens to be the typical fake american 'libertarian' (he's
>>> actually a mercantilist conservative - see what kind of 'free' market
>>> ebay is)
>>
>> No, the latest news is that Glenn still has nouns of steel and is still
>> publishing incredible news on a regular basis.
> 
> 
> 	OK...
> 

You could actually demonstrate that you see that Glenn, Laura and others
have taken real risks by doing anything at all to inform us. The way
that you behave, it is a wonder that they take such risks with people
who are so cynical and ungrateful as their peanut gallery. Lucky for the
rest of humanity that for every dozen people spending their energy being
so unkind, as you are, we have thousands who appreciate their efforts.

All the best,
Jacob




From pgut001 at cs.auckland.ac.nz  Mon Dec 16 21:23:43 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Tue, 17 Dec 2013 18:23:43 +1300
Subject: BlueHat v13 crypto talks - request for leaks ;)
In-Reply-To: <CA+cU71mMhSKA+DJW5DBWyJvBbGk1LLJGCBjK4BPwgvGvRs-sog@mail.gmail.com>
Message-ID: <E1Vsn8B-0003Cc-VG@login01.fos.auckland.ac.nz>

Tom Ritter <tom at ritter.vg> writes:
>On 14 December 2013 14:51, Peter Gutmann <pgut001 at cs.auckland.ac.nz> wrote:
>
>> For example if you
>>  follow DSA's:
>>
>>   k = G(t,KKEY) mod q
>>
>> then you've leaked your x after a series of signatures, so you need to know
>> that you generate a large-than-required value before reducing mod q.  The
>> whole DLP family is just incredibly brittle, a problem that RSA doesn't
>> have.
>
>This is different from the normal 'repeated/non-random k leads to private
>key', is it not?  Is there a paper/reference I can read more about this
>attack?

Yes, this is one of several variations of subtle leak-the-private-key issues,
rather than the standard obvious-leak-the-private-key.  The code comment I've
got has, alongside other observations:

           The best reference for this is 
           probably "The Insecurity of the Digital Signature Algorithm with 
           Partially Known Nonces" by Phong Nguyen and Igor Shparlinski or 
           more recently Serge Vaudenay's "Evaluation Report on DSA"

Then there's tricks like:

   Suppose that the
   certificate contains a copy of the certificate signer's DSA parameters,
   and the verifier of the certificate has a copy of the signer's public key
   but not the signer's DSA parameters (which are shared with other keys).
   If the verifier uses the DSA parameters from the certificate along with
   the signer's public key to verify the signature on the certificate, then
   an attacker can create bogus certificates by choosing a random u and
   finding its inverse v modulo q (uv is congruent to 1 modulo q).  Then
   take the certificate signer's public key g^x and compute g' = (g^x)^u.
   Then g'^v = g^x.  Using the DSA parameters p, q, g', the signer's public
   key corresponds to the private key v, which the attacker knows.  The
   attacker can then create a bogus certificate, put parameters (p, q, g')
   in it, and sign it with the DSA private key v to create an apparently
   valid certificate.  This works with the DSA OID that makes p, q, and g
   unauthenticated public parameters and y the public key, but not the one
   that makes p, q, g, and y the public key

That's not leaking the private key, but it allows signature forgery via
another mechanism that's totally unrelated to "was the fundamental DSA
algorithm implemented correctly".  As I said, the DLP algorithms are really,
really brittle, you have to worry about all sorts of things that aren't a
concern with RSA.

Peter.




From jacob at appelbaum.net  Tue Dec 17 11:15:42 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 17 Dec 2013 19:15:42 +0000
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed
 by Stewart Baker
In-Reply-To: <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>
References: <20131217050832.BDD772280D1@palinka.tinho.net>
 <52B092D8.9030706@appelbaum.net>
 <E1Vt01X-00059F-3N@elasmtp-masked.atl.sa.earthlink.net>
Message-ID: <52B0A2DE.7010702@appelbaum.net>

John Young:
> A good point, Jake. That status quo of commercial journalism.
> 
> What's better than advocacy journalism subservience?
> 
> How about an unfettered unredacted disclosure for unlimited
> access free of censorious redaction and withholding?

Yeah, of course. The clear answer is to ensure that this is done in a
sustainable manner as well. I don't mean fiscally either, I mean, more
than merely living through it and staying "free" for some sense of the word.

> 
> And giving up the "dump" red herring, WikiLeaks is unfairly
> accused of that, and has been considerably more various,
> experimental and risk-taking than professional journalism.
> It would do well to give up the privileged protection of
> journalism which demeans its reputation.
> 

I'm not sure that I follow but it sounds poetic, as usual, John. ;-)

> Exceptions to the cowardice of journalism abound, but have
> to be found so little are they known and credited beyond naming
> awards, and they defy the presumed status quo of what is
> permissable lawful and craven. Yes, many went to jail rather
> than bray about the jailing of others, reaping the rewards of
> consulting with authorities to maintain access.
> 

Indeed, on all counts.

> Hoped you had nutted Stew Baker, a lying sack of shit.

I pre-empted his 9/11 trolling by talking about the holocaust. It
clearly surprised him and the entire event was captured on video. He
blamed FISA for 9/11, I blamed the FBI, NSA and CIA for being a bunch of
criminals that exceeded their authority - without their misdeeds, FISA
wouldn't even exist. He had nearly nothing to say to this assertion. I
think he doesn't often spar with people who will go toe to toe.

All the best,
Jacob

> 
> At 01:07 PM 12/17/2013, you wrote:
>> dan at geer.org:
>> > all
>> > journalism is now advocacy journalism;
>>
>> All journalism is and has always been "advocacy" journalism. Often
>> people don't notice the so-called advocacy as it is usually for the
>> unjust status quo in an unquestioning, fully compromising subservient
>> manner, I'd add.
>>
>> All the best,
>> Jacob
> 
> 
> 




From jamesd at echeque.com  Tue Dec 17 04:15:22 2013
From: jamesd at echeque.com (James A. Donald)
Date: Tue, 17 Dec 2013 22:15:22 +1000
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
In-Reply-To: <20131217100611.GK7149@ctrlc.hu>
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <4814EE394F59D3ED56F19321@F74D39FA044AA309EAEA14B9>
 <CAGRDzQXjvLthzs9pV2Fheca3JW86c5nyA80UBV9XpbsbUrdBXg@mail.gmail.com>
 <1390263.IAfH59sb6t@lap> <52AFC940.8010100@echeque.com>
 <20131217100611.GK7149@ctrlc.hu>
Message-ID: <52B0405A.3000000@echeque.com>

stef wrote:
> > > I think that making working for NSA "srsly uncool, dude" is a very effective
> > > tactic, for example. Especially in the light of the "thanksgiving talking
> > > points".

James A. Donald wrote:
> > Will never work.  You overrate social pressure.

rysiek wrote:
> despite german government seemingly having serious problems recruiting
> competent devs for producing their own malware

Governments have serious problems recruiting competent developers even 
for stuff that many people approve of, for example the obamacare web site.




From grarpamp at gmail.com  Tue Dec 17 23:44:29 2013
From: grarpamp at gmail.com (grarpamp)
Date: Wed, 18 Dec 2013 02:44:29 -0500
Subject: HavenCo - Rebirth?
Message-ID: <CAD2Ti2_1Z=kk9=WYfnOz040tfUf9n1F1DdkitewWsT-1k=6uug@mail.gmail.com>

Highly doubt Ryan, Avi or any cpunks are involved, or
that much of anything will actually be in SeaLand.
Seems like a news driven oppurtunistic biz to cover
tower operation and maintenance costs.

Anyone have any facts?
Such as who's behind it and why?

http://www.sealandgov.org/sealand-news-1/HavenCo
http://www.havenco.com/




From coderman at gmail.com  Wed Dec 18 08:29:14 2013
From: coderman at gmail.com (coderman)
Date: Wed, 18 Dec 2013 08:29:14 -0800
Subject: acoustic side channel attacks against TEMPEST shielded equipment
Message-ID: <CAJVRA1ScnP7rDLD8eqBd92vg9TkWWKOWoZWtpFBntn0SeiqfTg@mail.gmail.com>

On Sat, Dec 7, 2013 at 3:24 AM, John Young <jya at pipeline.com> wrote:
> Contact mics for acquiring vibration and resonance emanations
> are among the still classified TEMPEST offensive and defensive
> activities,

interesting work on using poor quality sound (like from a phone) for
chosen cipher text attacks with key recovery for GPG.

also note that they use frequencies >10kHz.  as discussed in the high
frequency audio covert channel, this range is fairly contention free
and easily accessible to microphones in consumer electronics of
various types.


http://www.cs.tau.ac.il/~tromer/acoustic/
"""
Here, we describe a new acoustic cryptanalysis key extraction attack,
applicable to GnuPG's current implementation of RSA. The attack can
extract full 4096-bit RSA decryption keys from laptop computers (of
various models), within an hour, using the sound generated by the
computer during the decryption of some chosen ciphertexts. We
experimentally demonstrate that such attacks can be carried out, using
either a plain mobile phone placed next to the computer, or a more
sensitive microphone placed 4 meters away.

Beyond acoustics, we demonstrate that a similar low-bandwidth attack
can be performed by measuring the electric potential of a computer
chassis. A suitably-equipped attacker need merely touch the target
computer with his bare hand, or get the required leakage information
from the ground wires at the remote end of VGA, USB or Ethernet
cables.
"""




From laurens at daemon.be  Wed Dec 18 00:32:35 2013
From: laurens at daemon.be (Laurens Vets)
Date: Wed, 18 Dec 2013 09:32:35 +0100
Subject: Tor funding [was: ranting at Juan's hatebait rapaciously
 [before that, something about: request for transcript: Bruce Schneier and
 Eben Moglen discuss a post-Snowden Internet]]
In-Reply-To: <52B0D115.5070004@kjro.se>
References: <CAJVRA1Q0hKHX1YxqWumBNVFPMv-odpq2DvKwkKRt+YyxhoQ1QQ@mail.gmail.com>
 <52B0D115.5070004@kjro.se>
Message-ID: <898cdc5f12183e88121d4cba054389be@daemon.be>

Yes, you can. Make sure you bought them anonymously :)

On 2013-12-17 23:32, Kelly John Rose wrote:
> Funny question, can you donate anonymously with bitcoins?
> 
> On 12/17/2013 5:22 PM, coderman wrote:
>> On Mon, Dec 16, 2013 at 12:27 AM, coderman <coderman at gmail.com> 
>> wrote:
>>> ...
>>> b) you insist Tor's origins and funding sources are proof of
>>> malfeasance; they've responded by diversifying funding.
>> 
>> 
>> even more today :)
>> 
>> https://blog.torproject.org/blog/announcement-tor-project-now-accepting-bitcoin-donations
>> 
>> """
>> 
>> Over the past year, we have received many requests for us to accept
>> bitcoin donations. After careful consideration and research, we are
>> thrilled to announce that effective today The Tor Project is 
>> accepting
>> bitcoin donations. In partnership with Bitpay, bitcoins can easily 
>> and
>> directly be donated to support Tor’s ongoing mission of being the
>> global resource for privacy technology advocacy, research and
>> education in the ongoing pursuit of freedom of speech, privacy rights
>> online, and censorship circumvention. Check out ourdonations page 
>> now.
>> Bitcoin donations received by The Tor Project will be converted
>> directly to US Dollars.
>> 
>> Our decision to accept bitcoins has been well thought out and
>> researched from a financial accounting perspective with an eye on
>> passing our required annual A-133 audit. We believe we are the first
>> US 501(c)3 non-profit organization to test acceptance of bitcoins and
>> attempt to pass the US Government A-133 Audit Standard. Our 2013 
>> audit
>> results, along with our past financial documents, will be made
>> available on our website once complete in 2014.
>> 
>> The Tor Project is also proud to be in the company of other visible
>> non-profit organizations accepting bitcoins including EFF and
>> Wordpress.
>> 
>> Why is this important? The Tor Project needs your donations to
>> continue our mission and to keep the Tor suite of technologies ahead
>> with the growing threats to privacy and anonymity around the world.
>> Your donation made TODAY, through bitcoin, Paypal, Amazon Payments,
>> Givv.org, checks, money orders or bank transfers, will provide 
>> greater
>> security and privacy for millions around the world who use Tor every
>> day.
>> 
>> Help us continue our mission!
>> """
>> 




From jya at pipeline.com  Wed Dec 18 08:50:52 2013
From: jya at pipeline.com (John Young)
Date: Wed, 18 Dec 2013 11:50:52 -0500
Subject: [cryptome] acoustic side channel attacks against TEMPEST
 shielded equipment
In-Reply-To: <CAJVRA1ScnP7rDLD8eqBd92vg9TkWWKOWoZWtpFBntn0SeiqfTg@mail.g
 mail.com>
References: <CAJVRA1ScnP7rDLD8eqBd92vg9TkWWKOWoZWtpFBntn0SeiqfTg@mail.gmail.com>
Message-ID: <E1VtKK4-0005hg-2V@elasmtp-curtail.atl.sa.earthlink.net>

Excellent pointer. Full paper published today, 18 Dec 2013:

RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis, by 
Genkin, Shamir, Tromer:

http://www.cs.tau.ac.il/~tromer/papers/acoustic-20131218.pdf

At 11:29 AM 12/18/2013, you wrote:
>http://www.cs.tau.ac.il/~tromer/acoustic/





From electromagnetize at gmail.com  Wed Dec 18 11:15:43 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Wed, 18 Dec 2013 13:15:43 -0600
Subject: patterns & tracks (urls)
Message-ID: <CADhsnxcMKWD+inKTS7eT_B0HX2GC-Z_Zrwd7PbmK-=rbB8spZA@mail.gmail.com>

\:/:/:/:/:/:\:|:/:/

comment: so here in the Great White North, one year all of the sudden
many people on local television were complaining about the fact that
there is snow in Minnesota. i had never heard anyone in my life
complain about snow in Minnesota, as if it was a negative event. who
are these people? when did the population get replaced? - and it
seemed that another kind of person now existed in the area who was
fundamentally not from here else did not belong, and hopefully finds a
place they like better. rather than stand in snow complaining about
it.

so take an event X that has certain functioning and variables, that
could even be its nature, what makes it what it is (X).  thus, X=snow.
and then consider a place (MN) as being invariably tied to this
condition, such that MN=X within a certain range of parameters, say
'wintertime'.

and for many, as long as they have shelter, warm clothes and boots, it
can be an enjoyable time. if not, you may not survive. though snow and
winter have profound aesthetic value as a transformation from what is
known into another realization and understanding of the same place,
within differing parameters (light, color, temperature, clothing,
transportation, etc). so living in the north can be an education in
itself, knowing about winter, learning from it.

the larger situation is repeated elsewhere. in particular, in
educational contexts that have also migrated online as a type of
disapproval of certain natural functioning and awareness. most
notably, discussion groups online where a given [topic] will then have
limits placed upon its exploration, even though inquiries may fall
squarely within a given domain. and to this my response is similar:
who are these people, where did they come from?

for instance, the basic principles of [disciplines] such as
architecture can be censored in discussion or other areas (cultural,
technological) because it falls outside the artificial lines or
boundaries so conceived by a given ~managing population. such that
'the ideas' cannot be discussed, in their natural habitat, which
instead relies upon a definition of a place such that: place=not-X. or
in other words: topic = not-topic. insofar as it challenges a given
ideological boundary. and this can be as unnatural as believing 'snow
is bad' in Minnesota- fundamentally unnatural as a viewpoint. yet so
too, 'architecture is bad' for architecture, and onward. 'security is
bad for security' etc.

and perhaps this is evident in boundaries that are upheld and
constructed, maintained, such that certain issues and ideas cannot be
discussed due to enforcement of limits, and these may not have
anything to do with secrecy via NDA and instead, of wrong ideas and
thinking that challenge the status quo interpretation and belief
system (religion as state, essentially), yet that substitutes a
condition of truth with another, a pseudo-version that is fake, unreal
by comparison, and yet upheld as the basis for relation and exchange.

in that, having a negative view of snow in Minnesota, at least for me
and those i have known, is going against what makes this place what it
is, in its depth and connection with the area. and viewing 'ideas' as
negative that have this connection with a given topic or
understanding, likewise, unnatural and out-of-place. indicative of
other dissonance, ungrounded relations. to forbid 'ideas' of crypto
within discussion of cryptography, poo-pooing it, for instance, would
be an interesting realm to consider for how deep this disconnection
could go, thus revealing a surface relation or deception reliant upon
the not-X condition to sustain itself, or in this case, the need for
insecurity, obscurity, unknowing, disconnection, as vital to the ruse.
all such betrayels of truth reveal themselves in how truth is related
to, observed or ignored.

consider in this context, then, how might the government ever combat
issues of 'cyberspace' if its relation with electromagnetism was never
allowed to be established; such that:

     cyberspace = not-EM

on NSA interview on 60 minutes: it was stated that the interconnection
between various computer analysis systems (metadata) was needed to get
the 'whole picture', in that it is necessary to engage the situation
at the scale it exists. without this, conceptual blindness due to
limits or boundaries that prevent greater understanding of how things
relate.

now consider an entire university system, education system down to
gradeschool, that is forbidden from uniting its metadata beyond
compartmented views. that is essentially the condition today that
enforces illiteracy and makes it impossible to reason about advanced
situations beyond finite language games:

      culture = not-EM

everything that is connected via electromagnetism, and
interdisciplinary via shared structure and order of truth, is denied
by its lack of inclusion, allowance, and validation by authority - and
get this: on the basis for superior (private) belief based upon what
amounts to religious opinion, that instead censors truth so that this
wider viewpoint cannot be established. leave it up to some girls in
gradeschool to challenge the paradigm on a science project, the very
situation that cannot be addressed through reason otherwise, due to
issues of power.

the NSA gets its integrated metadata. the citizens and education
system does not. this is to include EMF hazards and electropollution
in relation to telecoms and telephony, etc. what about metadata of
[this] connected with contradictory data of [that], working all of it
out.


--:--: correlations :--:--

[video] Start-stop traffic helps penguin huddles grow
http://www.newscientist.com/article/dn24763-startstop-traffic-helps-penguin-huddles-grow.html

// if these analogous skills are not yet carried over into computing
// models, scenarios, analyses, the core concepts should be. think
// of how biomimetics influences drones and robots, and how the
// realm of detection, data tracking, movement has direct corollary,
// if not even transponders and tagging within a virtual approach...
Outdoor Action Guide to Animal Tracking
https://www.princeton.edu/~oa/nature/tracking.shtml

Outdoor Action Animal Tracking Cards
https://www.princeton.edu/~oa/nature/trackcard.shtml

note: irony of shtml; could see augmented reality apps helpful to
snapshot tracks, then database search and output hypotheses,
could be useful for mass inventorying by park rangers else a
SETI-like wildlife census by people in their local vicinities
where people can volunteer data for others research studies

rel. [image] snow music
http://lynneraeperkins.files.wordpress.com/2012/01/dsc011481.jpg

A story written in the snow...
http://tywkiwdbi.blogspot.com/2008/01/story-written-in-snow.html

Another story written in the snow  / (not-pc)
http://tywkiwdbi.blogspot.com/2008/01/another-story-written-in-snow.html
http://4.bp.blogspot.com/_SqhhJb_P3Kk/R38mCjzEM6I/AAAAAAAAAG0/ye9JbHUCitM/s1600-h/secretary%27s+car.jpg

_._._._._._

God particle signal is simulated as sound  / via hh
http://www.bbc.co.uk/news/10385675

note: first sample gives glass harmonica a run for its currency;
the second sample adds thunder tube in with harmonium;
third sample as if Laurie Spiegel electronic music composition

// must be a parable in there somewhere...

Non-transitive dice
http://tywkiwdbi.blogspot.com/2008/01/non-transitive-dice.html

_._._._._._


bit (digital/binary)
weighting, sliding-scale, gradient/strain-gage (analog) in context of loop



--- (my naive questioning) ---

is crypto used for online communications modeled in
conceptual 'flatland' or flat earth scenario,

how do the relational approaches exist dimensionally
or are the relations based on 2d dynamics and flow patterns

to what extent are _diagrams of relational exchange flattened
into a single layer or approach even while having various
features and different functionality (hierarchical nested sets)

could there be a conceptual limit or fixed approach that
starts considerations and modeling of dynamics in a given
domain/mindset and never leaves or goes beyond/outside it


// archeology, patterns, code, programming, language, culture...

[video] The Cyrus Cylinder: An Artifact Ahead of Its Time - {This relic
from ancient Persia had a profound influence on the Founding Fathers)
http://blogs.smithsonianmag.com/aroundthemall/2013/03/the-cyrus-cylinder-goes-on-view-at-the-sackler-gallery/

The Monolithic Sculptures of Data Viz Whiz Edward Tufte
http://gizmodo.com/the-monolithic-sculptures-of-data-viz-whiz-edward-tufte-1484955132

Snowden: NSA's indiscriminate spying 'collapsing'  / via drudgereport
http://news.yahoo.com/snowden-nsa-39-indiscriminate-spying-39-collapsing-39-122308716.html

[quote] "There is a huge difference between legal programs, legitimate
spying ... and these programs of dragnet mass surveillance that put
entire populations under an all-seeing eye and save copies forever,"
he wrote. "These programs were never about terrorism: they're about
economic spying, social control, and diplomatic manipulation. They're
about power." [unquote]


--- electromagnetism & culture ---

It’s a Man’s World, And It Always Will Be  / via drudgereport
http://ideas.time.com/2013/12/16/its-a-mans-world-and-it-always-will-be/print/

[quote]  Over the past century, it was labor-saving appliances,
invented by men and spread by capitalism, that liberated women from
daily drudgery. [unquote]


note: there is a tremendous story in electrification of household
and city that someday should become general knowledge because
there is a lot to learn about technology, social relations, culture
through greater understanding of the daily inhabited environment;
(the book Electrifying America by David E. Nye is one such account)
for instance, you could take any appliance or artifact and map it out,
back to previous dynamics, say a ice box compared to e-refrigerator,
or iron heated on fire to electric iron, its relation to laundry room of
washing machine and dryer. how these effected social roles, etc.

e.g. electrical desk light, radio, computer, home alarm systems.
note also: importance of certain items connected to ecosystems,
say alarm system with external security monitoring and police. the
relations be mapped out via typology: tools, buildings, and systems.
in architecture a big event was the geometric relation in the kitchen
between sink, refrigerator and stove in a triangular arrangement...

Kitchen work triangle
http://en.wikipedia.org/wiki/Kitchen_work_triangle

it should also be mentioned that this type of 'feedback' is potentially
possible and valuable in any work or routine process, where it could
function in more or less efficient or effective ways. and this can be
connected to individual lives or managerial issues within companies
that either allow for such local perspective or seek a top-down model
where the viewpoint and ideas only originate from a given vantage,
and this could distinguish an intelligent and adaptive organization
from a rigid approach that is stuck in time and ultimately overtaken
by others innovation- thus relation of processes and functioning
with business philosophy, application of principles, their mediation
that can have economic, social, political effects, un-shared beliefs, &c.
(for instance, a worker in a production process has insight into how it
is and is not effective and can offer feedback for tweaks, improvement
or not allowing this and having that inefficiency/ineffectiveness built-in
and then normalized, including as relational ideology, that can limit the
engagement with the situation or force disengagement, detachment.
in other word, testable hypotheses of flow and routine functioning or
are these unquestioned and enforced to uphold given social relation)
likewise, what may appear only commonsense today - having enough
room to maneuver in the kitchen and use appliances effectively - can
extend as a conceptual question into the present and future day, such
as how the pantry, kitchen, and e-commerce in an automated scenario.
this was part of the idea for the Asperger Management System (AMS),
whereby a home computer system (data furnace) would use A.I. to bid
on restocking pantry, perhaps even in a financial market sense, where
'group bids' for a local community could exist to purchase wholesale,
and so an exchange could develop and suppliers to fill the contracts.
this would then integrate the 'intelligent refrigerator' with pantry,
and then have an A.I. data furnace device manage routine orders,
based on patterns that could include weather, past price history.
and of course a dwelling would need a way to store/allow packages
when people are away from home, to allow deliveries at any time.
note here the vital role of both encryption and security protocols.

(this leading to how existing courier/shipping services function, in
that people can wait all day for an e-commerce shipment to arrive
when instead an e-commerce portal or secure drop box could exist,
and before that, wireless updates when a driver is on their way to
a destination, providing a 30 minute window or lead-time vs. 8 hrs
via wi-fi and network-based updates of when a package may arrive)

_._._._._._


Make a contact mic with baking soda and cream of tartar
http://leafcutterjohn.com/?p=1518


// hard to imagine there would be no scaled macro-effects,
// especially in charged atmosphere, if not influence on dust,
// wildlife sensing, peoples mental states, invisible toxic smog
// more dangerous than black sky of 18th c. industrial revolution

What If You Could See Your Cellular Network? // via hh
http://www.myvouchercodes.co.uk/#cellular-network

note: this is cellular network only, apparently. now imagine many
if not most online/broadband households having wi-fi turned on,
whether or not in use, HDTVs, printers, audio gear, computers,
routers, at the level of the household. would be interesting to
know # of wi-fi device per, as statistical average then extrapolate.

(great that engineers involved in this art-research visualization)

now what if with GIS and GPS every antenna lease could be mapped
into grid and antenna/radiation patterns mapped locally. such as:
look at schoolkids environment, top floors of apartments, etc.
this information should be open to the public and 3d visualized


// author Ray Bradbury and Isaac Asimov on public libraries.
// internet as public library, yet those access fees, esp. mobile data*

"I don't believe in colleges and universities" - updated
http://tywkiwdbi.blogspot.com/2010/06/i-dont-believe-in-colleges-and.html

[*thing is, if you are not a phone talker, a mobile phone makes little sense
especially if main use would be mobile data, which is made so economically
infeasible, so hostile to lookup of data, the hurdles to just sustain massive
locked-in access prior to any data, removes value of info or turns it into an
extreme luxury only elites can access beyond chained to wi-fi providers,
which is yet another service provider reduplicating access, only for mobile
and only in limited zones, at least in this area. then again: EMF POLLUTION.
basically there is tremendous downside to the entire scheme for citizens,
they get irradiated, swamped by harmful EMFs, yet access is uncorrelated
to this ubiquitous hierarchical covering of the landscape, no useful signals]


[image] "Cross sea" and "cross swell"
http://tywkiwdbi.blogspot.com/2013/12/cross-sea-and-cross-swell.html

[image]
http://www.modeskine.com/wp-content/uploads/Calendario_Vespa_Piaggio_1996_Dicembre-728x1024.jpg


--- ze kollider funktion ---

[image]  R. Crumb's A Short History of America  (original)
http://www.kunstler.com/Grunt_Crumbshorthistory.html

[image]  Special report: G2 in Crumbland
http://arts.theguardian.com/crumb/images/0,15830,1430854,00.html

-- more...

Robert Crumb
http://en.wikipedia.org/wiki/Robert_Crumb

R. Crumb Poster: A Short History of America -- 15 panel version
http://deniskitchen.com/Merchant2/merchant.mvc?Screen=PROD&Product_Code=P_SHOA

The Seven Chakras of R. Crumb
http://beingsakin.files.wordpress.com/2011/07/the-seven-chakras-of-r-crumb.jpg


--- crypto email & et al ---

reading of how crypto systems could be implemented for email, perhaps
to include chat and file transfers even, alike with web browser
functionality and perhaps extending it with SSL secure icon that
validates connection status.

anything short of this would appear too complicated for ordinary
users. that is, a simple icon that is pressed or depressed to decrypt
or encrypt/re-encrypt information within a personal computer operating
system slash desktop environment, moving to mobile operating system
and its micro UI likewise.
of anyone who could implement such a simple interface for managing
crypto it would be Apple, Inc. and yet, then again, the problem
remains of 'the keychain' paradigm as a basis for managing keys,
certificates, passwords and other items that has remained a mystery to
me. in that its use is not apparent to the uninitiated, though it
supposedly performs some function or other, though it appears manual,
requiring management and maintenance and knowledge of what to use it
for and how- efficiently and effectively. and that is the missing
information though also an area of non-Mac like roughness in
functionality, in that encryption does not appear to be part of the
seamless experience on par with importing GarageBand files into iTunes
or email or something such- versus protecting identity, privacy,
information, files from illegal snooping and intrusion. as if
essentially leaving the bank vault open for any visitors. though the
entire drive can be encrypted on the fly, data that is sent and
received is not automated this way, as far as could be understood via
the basic feature set and settings.

(it should be said of Apple, of the great hardware innovation since
the 1980s, and nearly no innovation in the operating system itself as
paradigm, remaining file and folder junk drawer and thus stalled out
conceptually in terms of information organization and 'tools for
thinking' beyond ongoing bureaucratization, where the CPU binary
approach itself is determining and limiting functionality, and cannot
be altered from its existing course as solidified, seemingly. in that
a new computer architecture likely needs to be introduced to make
basic changes to the informational paradigm, what can be done vs. what
is done as it continues to be done)

on the Macintosh platform it appears possible that a basic 'icon'
approach could work, such that in any given application a 'lock' or
'secure' status could be engaged/disengaged, when wanting to
send/read/write an encrypted email, or decrypt a file, or communicate
via chat. and that whatever data is involved, archived or store, could
likely be held in a vault that is encrypted outside the normal
whole-disk encryption, whether emails or files, and that this would be
locked by default (apparently this is part of Keychain management
functionality, if not mistaken, at least for passwords).

in other words, a computer user could decide they want to write a
secure message via email and press an icon (aka switch or button) that
changes the visual interface to a new state, a phase change indicating
'secure session' (say a gray striped bar occurs around the perimeter
of the windowpane) and then when the document is either closed and
saved (changing phase again, say black striped bar aside filename) or
sent, that this document is secured automatically by protocol, such
that once the decision for security is made, it is automatically
followed through as a process and thus the email would automatically
lock-down before being transmitted, and upon receipt by another would
need to be unlocked to be read, and when closed would relock itself
via encryption scheme. and any such documents or files would be held
in a secure information  vault and could be accessed via a security
manager interface that would be integrated into various software,
including mobile.

therefore, once logged onto a computer (identity validated via perhaps
advanced measures such as biometrics and-or other) then a person could
just click the icon to access or compose data, and not need to worry
about keys or authentication, though perhaps an additional layer could
exist as a security option (prior to sending or opening) if need be.
say fingerprint scanner beside computer, to unlock files to read or
send via email.

anything less than this - of a computer vender who controls the OS and
hardware and can unify and embed the 'security infrastructure' within
an existing ecosystem - probably could not control enough factors to
make it work in these ecosystem terms. that is, a basic unified
experience from start to finish in the exchange or dynamics of
interaction. Apple can. and if Apple can, within its own OS-iOS
platform, then others can follow up, which would enable cross-platform
functionality within given standards- whatever they may be.

without this self-contained trial of 'icon'-based crypto and working
through the usability issues - so that it is dead simple and effective
- which is what Apple excels at, rolling out such 'solutions' in a
larger realm would likely be met with unmatching interactions and the
problems of fragmentation that limit such cross-platform exchange in
shared standards and-or frameworks and security definitely loses out,
or is non-existent, due to such dynamics. in that if even different
computers cannot trust one another, how can people be expected to.

so how could a 'secure file' be sent to another if the computers
themselves do not have enough trust to establish, manage, or maintain
this connection. it would appear a systematic approach is required
that can then be extended once it is worked out as a security process,
vetted by professionals, to allow a new level or layer of personal
security in response to the issues and problems of ubiquitous
surveillance, to design a private perimeter that extends beyond -bank
transactions online-and involves all data of value that requires
security, more protection and limits from unauthorized and non-legal
snooping, seizure, and manipulation.

-:-:-:-:-:-

Crows could be the key to understanding alien intelligence / via hh
http://io9.com/crows-could-be-the-key-to-understanding-alien-intellige-1480720559

Your wireless router could be murdering your houseplants / via digg
http://www.dailydot.com/lifestyle/wireless-router-wi-fi-plants

('An experiment by a handful of high school students in Denmark')

>> moral of story: keep chia pet away from router & mobiles phones??


{educational fair-use of copyright, 2013}

endomorph  Rutherford  citral




From dan at geer.org  Wed Dec 18 16:52:31 2013
From: dan at geer.org (dan at geer.org)
Date: Wed, 18 Dec 2013 19:52:31 -0500
Subject: Fwd: Jacob impervious to "Rubber Hose Cryptanalysis" performed by
 Stewart Baker
In-Reply-To: Your message of "Tue, 17 Dec 2013 18:07:20 GMT."
 <52B092D8.9030706@appelbaum.net>
Message-ID: <20131219005231.44272228109@palinka.tinho.net>


> All journalism is and has always been "advocacy" journalism. Often
> people don't notice the so-called advocacy as it is usually for the
> unjust status quo in an unquestioning, fully compromising subservient
> manner, I'd add.

Perhaps, as you say, it was always thus at least in terms of bias
of intent, but there seems something qualitatively different between
the yellow press of yore (where stories were made up) and the press
that is now in a world so awash in news stories that any "channel"
can deploy its bias solely via story selection, i.e., it can lie
using nothing but truth.

Take that one phrase you selected to comment upon; it is entirely
true that I wrote it, and it would be entirely legitimate to disagree
with it in and of itself were it the point, but that phrase was a
member of a series of supporting elements in an argument that
polarization, a marker for societal strain, is proceeding on our
watch.  As Camille Paglia wrote, "...history's far darker lessons
about the cyclic rise and fall of civilizations, ... as they become
more complex and interconnected they also become more vulnerable
to collapse."  Polarization, that sublimation of the middle, is my
point, and to go one step further, technologic progress is its engine.

N.B., we are now waist deep in a rat hole.

--dan




From dan at geer.org  Wed Dec 18 19:00:52 2013
From: dan at geer.org (dan at geer.org)
Date: Wed, 18 Dec 2013 22:00:52 -0500
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss a
 post-Snowden Internet
In-Reply-To: Your message of "Tue, 17 Dec 2013 05:03:23 PST."
 <1387285403.68404.YahooMailAndroidMobile@web160703.mail.bf1.yahoo.com>
Message-ID: <20131219030052.445312280B6@palinka.tinho.net>


 > Obama probably didn't pay its developers enough to get solid
 > coders. Hence a scrappy web system.

Au contraire, Monsieur, beaucoup d'argent.

nypost.com/2013/11/01/obama-donors-firm-hired-to-fix-web-mess-it-helped-make

Thinking out loud, if Quality Software Services was selected
for this most visible effort, then they must have a track
record with Federal agencies.

And they do (read, they're wired).  One (only) example:

  Quality Software Services, Inc. Wins $109.93 Million Federal Contract
  for Medicare and Medicaid Services
  Jun 20 12

  Quality Software Services, Inc. won a federal contract valued at
  up to $109,926,956 from the U.S. Department of Health and Human
  Services' Centers for Medicare and Medicaid Services, Baltimore,
  for enterprise identity management services under the American
  Recovery and Reinvestment Act.


So they are in the identity management services game, which
means that they already have your number, so to speak.  And
are pre-existing contractors to Health & Human Services.
Yet more searching discovers that all the key management
personnel have TS clearances, but the firm seems to never
have had TS contracts, so one can argue that the clearances
were gifts for friends.

This is a rat hole...

--dan




From electromagnetize at gmail.com  Thu Dec 19 12:17:59 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Thu, 19 Dec 2013 14:17:59 -0600
Subject: PVDF and you - (01)
Message-ID: <CADhsnxf+y8w9sFtnAPc5_Ozu+4Vid1q=agMvJLKzmBbnTK=SgQ@mail.gmail.com>

so i have been researching PVDF piezo film sensors
via a technical manual [0] and there is a lot here that
may be of potential interest in terms of its applications,
[1] especially its use in security systems and to prevent
tampering, and energy harvesting, in addition to other
areas where its unique functionality could be explored.

what follows, a series of short posts about this material...


0a. Measurement Specialties PVDF technical manual (PDF)
http://contactmicrophones.com/techman.pdf

0b. technical manual with Appendix of piezo film articles
http://www.tufts.edu/programs/mma/emid/piezo.pdf

1. Measurement Specialties Piezo Film Product Guide
http://www.meas-spec.com/downloads/Piezo_Film_Product_Guide.pdf

---

so PVDF is 'piezo film' that has unique properties and
capabilities. while i know little of functional electronics,
it is said to be a capacitor that stores and discharges
high voltage energy. like a piezo disk it picks up the
vibrational energy due to structural deformation that
then generates or moves charge in response to this.

the application i recently first encountered it was with
'contact microphones' - where it was stated that these
PVDF film tab mics record the vibrations as sound input
rather than acoustic pressure of condenser and dynamic
capsule microphones reliant on soundwaves moving the air.

so the distinction is that this piezo film can function as
a recording input or SENSOR though by registering the
vibrations on the surface of a material. what is more, it
also detects temperature differences and thus can be
employed as a sensor this way as well, which i did not
realize was possible nor expect for a 'microphone'.

the PVDF film apparently is already used in security
applications within computers, if not crypto systems
protected from tampering, via vibration sensing that
triggers lock down or equipment destruction based
upon monitoring of piezo film signals at perimeter.

PVDF film for Tamper-Proofing, Security (white paper)
http://www.meas-spec.com/downloads/Applying_Piezoelectric_Film_in_Electronic_Designs.pdf

(interesting likewise is use of piezo coaxial cable for
perimeter security, strung on fencing as a microphone
and also buried underground, which then can register &
record raindrops, footsteps, people climbing fence, etc.)

to be continued: ideas and observations about PVDF...


spatter glass, azimuth circle, rift zone




From electromagnetize at gmail.com  Thu Dec 19 13:31:24 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Thu, 19 Dec 2013 15:31:24 -0600
Subject: energy harvesting via PVDF - (02)
Message-ID: <CADhsnxfzfh7pvOnuXsCfs1kuiPwu-inaFNiW9E12Bnnd5BNfvw@mail.gmail.com>

okay, so the big surprise for me was that this piezo film
technology lines up directly with an energy harvesting
article from a recent (urls) list. excerpted again below:
---------------------------------------------------------------------------

// contact electrification using patterned nanomaterials...
// note: the gap, equilbrium via chargeflow, as if via entropy.
// discovery originating from malfunctioning piezo-sensor...

Capturing wasted electricity with triboelectric generators
http://phys.org/news/2013-12-capturing-electricity-triboelectric.html

[quote] "Beyond generating power, the technology could also provide a
new type of self-powered sensor, allowing detection of vibrations,
motion, water leaks, explosions – or even rain falling." ... "They
have learned to increase the {power output density by a factor of
100,000} by applying micron-scale patterns to the polymer sheets. The
patterning effectively increases the contact area and thereby
increases the effectiveness of the charge transfer." [unquote]

---------------------------------------------------------------------------

from what i have read about PVDF, it would seem possible
that a similar nanopatterning could be etched onto the piezo
film surface that is bending or strained, and via this more
intense grid or array it may be possible to likewise up the
capacitance or charge that can be held and stored within
piezo film, (patterns like a step-up-transformer perhaps),
based on the above, if indeed a non-piezo film investigation.

the characteristics appear identical: LEDs need enough
voltage to light, and a constant current to maintain lit, and
thus the high voltage of material difference or 'gap' in the
original news story (linked above) indicates that a high
voltage is _momentarily transferred that is enough to
light up an array of LEDs, though only for an instant.
and this becomes an application for energy harvesting.

so it should be notable if the PVDF film also shares these
properties, that it generates a high voltage that can be sent
into a circuit, though likewise it is a momentary not constant
charge and thus particular circuits would need to be designed
to allow it to function as a source of energy for a self-sustaining
circuit (energy harvesting) rather than just pushing out current,
unless somehow it was possible to get it moving in that way...

i.e. constant vibration -> high voltage -> constant AC current

(these observations from someone who knows nothing about
these things, beyond trying to understand the fundamentals
of basic electronics components and their functioning. yet
enough to ask questions and make a few assumptions...)

so it appears to be an issue of a trickle-charge circuit, that
the PVDF film would vibrate and offload that current into a
another capacitor where it could be stored until a usable
amount and then accessed for low-power functionality of
some super-efficient circuit design, PVDF the powersource.

so for this trickle charge circuit, it is imagined:

  PVDF film --> diode --> supercapacitor --> "circuit"

whereby 'vibrational energy' is powering the overall circuit,
which in crypto or security terms could be sensing-related
or monitoring or sniffing data via low-power and stealth, etc.
or perhaps even transmitting information or code or relaying
or capturing infrasound data, where vibration both provides
power to the circuit and information (high metaphysics)

from what i have read, the current is AC from the piezo film,
and then another capacitor would turn it into DC if this is not
mistaken, for use in such a circuit- this only an approximation
of what the most basic issues might involve, if also incorrect
though i figure many here have the information and knowledge
to resolve such issues if inquiring further, thus; 'about ideas'


so at this stage, as with everything: things start to get weird...

perhaps it is because of my lack of knowledge or involves some
basic misunderstanding that i am simply incapable of realizing;
though this little electronic component is essentially some kind
of strange antenna device, and if it can be made to vibrate then
it generates power; so if it constantly vibrates, it constantly is
able to generate current and thus replaces a battery in a circuit

so to get usable current, the key is to either trickle charge and
build up and store energy over time, to a point that it can be
used at normal levels, or to generate a frenzy of energy via
constant activity that strains the PVDF film, creating a flow
of alternating current that can be immediately turned to DC
as powersource, and thus 'live power' vs. a delayed approach

(maybe oversimplifying or confusing the electronics issues
or paradigms involved, though this is how i am relating to it)

why does it matter?

well, from what i understand after listening to my friend who
is a composer, making a film on a Nikola Tesla, whose studies
and research focuses on 'music as an energy system', [0] [1]
also in relation to my own investigations of logic (A=A) as this
relates to her study of tuning systems and "resonance-based
energy transfer" (somewhat in the range of wireless power, yet
non-electromagnetic, involving vibrations, not moving of charge)-

if there were a vibration that existed that could be tapped into
by this PVDF piezo film -as antenna- and it could be made to
vibrate constantly, then *bingo* -- it is access to free-energy

and i am only thinking these specific thoughts because of hh,
and would be nowhere in this vicinity with my own investigations
which tend more towards the HIOX model though interest of this
realm of electronics is extreme at the same time as my illiteracy
and incapacity, thus words must substitute for actual experiment.

and so piecing it together- under such guidance, it is verified by
others who are expert that this constant vibration exists within
the environment already, today, now, and for billions of years
presumably. it was investigated by Nikola Tesla, where the
area between the ground of earth and the dome of sky in its
upper atmosphere create a waveguide or sorts, known as
the "Earth-ionosphere cavity" [2], which in turn generates a
vibrational frequency known as the Schumann Resonance [3]
that provides a source of constant vibration at 7.83 Hz resulting
from lightning strikes in the atmosphere which then creates this
giant battery in the sky, that in turn could be tapped into, both
in non-electromagnetic terms, via vibration, and likely as with
lightning, electromagnetic terms, as a source of power.

so it cannot be this easy, right. gotta be missing something.
and if i could design the circuit and figure it, i would know, and
yet i cannot and so share my puzzlement, inquiring: why not?
what am i missing, what do i fail to understand of the situation?


in other words, if you can get the PVDF film vibrating by tuning
into the 7.83 Hz frequency of the Schumann Resonance, you
would have access a local instance of perpetual motion, as long
as the dynamics retain the existing characteristics, indefinitely

continued...


0. helen hall - composer, filmmaker
http://www.helenhall.net

1. Pictures of Infinity -- film about Tesla & aether
http://picturesofinfinity.net/

2. Earth-ionosphere cavity (diagrams)
http://www.glcoherence.org/templates/gcp/images/monitoring_system/earth_rhythms/diagram_schumann_resonances_ionosphere_cavity.jpg
http://www.vlf.it/Schumann/cavity.gif

3. Schumann resonances
http://en.wikipedia.org/wiki/Schumann_resonances


oratorio, amaryllis, Teller




From electromagnetize at gmail.com  Thu Dec 19 14:34:01 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Thu, 19 Dec 2013 16:34:01 -0600
Subject: PVDF as antenna - (03)
Message-ID: <CADhsnxcXy8TzYeWHBnd2umJ-KLsV-bXhLjJ_Za0CefXuWwHA5A@mail.gmail.com>

from this vantage of not-knowing, and having experimented
some with breadboards and the Parallax Basic Stamp
microcontroller platform, it would again seem possible
that if the PVDF were conceptualized as an antenna that
when it is geometrically aligned does not just access a
realm of signals, and instead, this signal is itself energy
that correlates directly with a capturing of voltage within
the piezo film as capacitor, such that an 'energy antenna'
exists and perhaps this is the basis of energy harvesting,
though seemingly is bounded by how it is implemented.
in that its application appears to be requiring mechanical
energy, affixed to a surface which bends the material as
the basis for vibration, than tuning into a frequency that
is detached from the sensor and yet resonates it via the
correspondence and alignment of shared tuning (A=A),
and in this way motivates charge within a larger circuit.

so there are whitepapers that exist about self-sustaining
circuits based on PVDF and microcontrollers [0] and yet
nothing in this other realm about the 'global AC circuit' [1]
as this could also influence movement of the antenna in a
framework beyond that of sidewalks and HVAC vibrations.
in that atmospheric electricity and the earth-ionosphere
cavity [2] have fundamental relation to EM technologies

thus, stating the obvious in an expanded view beyond
that of a compartmentalized realm, this condition of being
within such an environment, yet not having it understood
or conceptualized based upon a false limit or no-go zone,
as if fringe to consider or perhaps not obvious to those
without instruction, the educational system enforcing a
fundamental disconnection, as if to keep everything that
is naturally connected apart, as if somehow beyond limits

thus basic electromagnetic awareness, to then read the
technical manual [3] where it states the following:

"Although the forces involved are small, the film can be used to
excite other mechanical structures over a very wide frequency range.
If a second element of film is used to receive the induced vibration,
the system can possess a very high dynamic range, even though the
overall "insertion loss" due to the film is about -66 dB typically for
a structure at resonance. If sufficient gain is applied between these
elements, the structure will self-oscillate at its natural frequency.
For these resonant mechanical systems, high voltage drive is not
required. The amplifier circuit may function adequately from a normal
dual rail op-amp supply, or even from a single 9 volt battery. For
analysis purposes, even lower applied voltages, e.g., the noise source
of a spectrum analyzer at 70 mVrms, are sufficient to insert the
mechanical energy into a structure when piezo film is also used to
monitor the result." (p.5)

now consider again the issue of tuning and shared resonance,
that the movement of one object at a certain vibration/frequency
could induce another object to also vibrate at that frequency if
the resonance was shared or tuned similarly.

thus, a PVDF film 'transmitting antenna' could seemingly generate
a vibration at a given frequency, and if matched to anther PVDF film
as receiving antenna, could induce it to vibrate and in effect, transfer
or transmit the power from one circuit into another, via this vibration.
i.e. resonance-based transfer of energy, or remote power generation

so you could place a microcontroller antenna tuned to a frequency
a few feet from another, on a separate circuit, and seemingly then
light up its LEDs via vibrational energy, no electromagnetism that
spans this gap, and instead resonance or vibration as the medium.
(note: non-acoustic seemingly because it is the material itself that
is vibrating and not "acoustic" air pressure pushing it to vibrate.)

note: in this way it is clean, non-pollutive, and nonradiating energy
and this is what Tesla had discovered apparently, and yet it was not
able to be developed further, given the all-encompassing situation.
and yet, listening to the stories of hh, she conveys that Tesla who
had developed alternating current infrastructure thought in retrospect
that it was unnatural and harmful as an energy approach, and that
this resonance-based energy was based upon natural cosmic order,
and was correctly aligned with life and nature, not functioning against
it via invisible toxic pollution of radiation and its massive inefficiencies.


so now there are two major themes: one is energy capture via the
Schumann Resonance, and another is non-electromagnetic transfer
of power via antennas tuned to a shared frequency, whereby current
from one circuit could induce it in another. this is different from the
magnetic induction whereby magnetic fields bridge the gap between
transmitter and receiving device, and any electric or electromagnetic
version likewise, whereby current is bridging this gap, ionizing the
air inbetween, breaking down the structure of the air to move energy,
versus nontoxic vibrating at some imperceptible infrastructural layer
that is already active within nature, which all entities are attuned to
as part of a living ecosystem and circuit, yet also out of harmony and
out of balance via technology and development in the present moment,
with populations unable to grasp the hostile situation we exist within,
environmentally, ecologically, educationally, intellectually, realistically
in the dimensions & parameters that exist, for optimal decision-making

what then if the approach or conceptualization is off, and equipment
and tools exist for experimentation like early days of electrification,
where hobbyists can turn inventors and transform the situation by
exploring beyond the edge already defined, via new interpretations
or accessing old, discarded ideas and knowledge, thinking it through
once again, and perhaps massive discoveries await via such experiment

continued...


0. Powering Microcontrollers with Scavenged Energy
http://www.digikey.com/us/en/techzone/energy-harvesting/resources/articles/powering-microcontrollers-with-scavenged-energy.html

Evaluating the Options for Different Technologies to Harvest Energy
>From the Environment
http://www.digikey.com/us/en/techzone/energy-harvesting/resources/articles/evaluating-the-options-for-different-technologies.html

1. global electrical circuit (images)
https://www.google.com/search?q=global+electric+circuit&client=firefox-a&hs=Fm7&rls=org.mozilla:en-US:official&channel=np&tbm=isch

2. Atmospheric electricity / Earth-Ionosphere cavity
http://en.wikipedia.org/wiki/Atmospheric_electricity

3. Measurement Specialties PVDF technical manual (PDF)
http://contactmicrophones.com/techman.pdf


{educational fair-use of copyright, 2013}

laugh track, nosebleed, telamon




From electromagnetize at gmail.com  Thu Dec 19 15:22:50 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Thu, 19 Dec 2013 17:22:50 -0600
Subject: tuning piezo antenna - (4)
Message-ID: <CADhsnxcK-o2Wc0WBJ0zrukfpLQBAGVx38Q4WCyiKdqVLtrXWRg@mail.gmail.com>

basically at this juncture there are questions of piezo film itself,
and then how to control this within a circuit, which could also
involve information transfer, and thus microcontroller platforms
are probably involved in such experimentation and development.

so how i approach this situation is that i look at what is available
for piezo film sensors, and contemplate how that plastic-coated
piezo film could be made to vibrate automatically or function as
a non-radiating transceiver of 'resonance-based' energy as signal.

and thus the options are basically for little rectangle tabs of film
that plug into a breadboard circuit of a microcontroller or else can
be soldered to a circuitboard, as with various other approaches. [0]
e.g. the DT Series from Measurement Specialties is the same type
of strain-gage sensor found in contact microphones. [1] though i was
still completely puzzled by another version of this element that has
a round metal opening in its otherwise flat surface as if a mistake
occurred at the hardware store. as if a pierced PVDF sensor. [2]

and then after a google search i happened upon a experimenter
who built an Arduino Seismic Activity Monitor [3] using the same
PVDF element and it was then realized the hole in the piezo tab
related to its use as a cantilever that vibrates and that additional
weights can be added to limit what frequencies influence it, thus
the antenna can be tuned to respond to only certain frequencies,
or in the larger consideration, potentially to resonate in a narrow
window where it could be specifically tuned to, say- 7.83 Hz, if
indeed it either could be manufactured this way as an antenna
or retrofitted via weights or modifications. or so it seems possible.

in other words, having once had access to a seismic sensor, the
range in which the vibrations would trigger the circuit could be
fine-tuned to a certain limited parameter which could potentially
influence inefficiency or limit any outside involvement, harmonics
from powerlines or ambient noise that could lessen or disrupt the
clean or predominant movement, seemingly. like only having one
vibration versus several that counteract and diminish one another,
though perhaps in some cases harmonics could be beneficial and
in others counteract the movement. those who know would know.

(sidenote: interesting to consider precisely because such a sensor
can still be used as a microphone element and could be tuned or
adjusted to pick up stray signals or vibrations from the environment,
say the 60 cycle hum of alternating current, more on this later..)

so, tuning of the adjustable PVDF film tab apparently involves
either guesswork or use of an oscilloscope, which i wish i knew
how to use because it seems the conceptual foundation of the
diagnostics of electronics and circuits, how to relate to and
understand them in detail and without it, the multimeter in its
non-graphic approach remains to me an issue of numbers only,
never having understood how all of it fits together as a worldview.

though it is evident that it is possible to put weights onto this
cantilever of the sensor and then measure it so that it only can
vibrate within a certain wavelength, or frequency, in this case it
was bounded for earthquake sensing, to a lower range and thus
filtering out all the higher frequencies that could influence if not
trigger the sensor, said to be extremely sensitive to vibrations,
otherwise. what this amounts to is: if you know electronics and
know circuits and have an oscilloscope, you could probably tune
the antenna to a particular frequency range, whether to transmit
or receive crypto data as infrasound (seems unlikely as transmit,
though receive apparently a-ok, if material connection is vibration,
again not acoustic or in air; thus computer chassis, cables, etc)
or at ultrahigh frequencies (transmit/receive seemingly both ok.)

thus perhaps someone with the know-how to see if it is actually
possible to transmit data via resonance-based vibration, where
movement is induced in another circuit, becoming power for that
circuit, else also transmit data via non-electromagnetic means,
on the principle of shared tuning. (there is more to this, opening
up and tapping into the infinity of a circuit, and somehow having
this drive the vibration of the PVDF ((which is more 'the aether'
from what i understand, not of this dimensionality)) though that
is for some other investigation, in some other time and place.
this involves challenging existing mathematics of zero, etc.)


in any case, the point here is that there could be multiple ways
of tuning the piezo film as an antenna within these parameters,
and it could involve differing approaches or circuits to do so.


[0] example of Piezo Film Elements
http://www.meas-spec.com/piezo-film-sensors/piezo-film-elements.aspx

[1] Piezo Sensor - DT Series
http://www.meas-spec.com/product/t_product.aspx?id=2478

[2] Piezo Sensor - LDT Series
http://www.meas-spec.com/product/t_product.aspx?id=2484

[3] Arduino Seismic Activity Monitor - Ethernet Shield
http://www.instructables.com/id/Arduino-Seismic-Activity-Monitor-Ethernet-Shield/?ALLSTEPS


recover, tremulous, lie detector




From jamesdbell8 at yahoo.com  Thu Dec 19 18:42:06 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Thu, 19 Dec 2013 18:42:06 -0800 (PST)
Subject: Malware that's transmitted through sound
Message-ID: <1387507326.61515.YahooMailNeo@web141206.mail.bf1.yahoo.com>




http://www.designnews.com/author.asp?section_id=1386&doc_id=270551&cid=nl.dn14&dfpPParams=ind_184,industry_consumer,aid_270551&dfpLayout=blog
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1662 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131219/c23eed3f/attachment.txt>

From electromagnetize at gmail.com  Thu Dec 19 18:34:03 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Thu, 19 Dec 2013 20:34:03 -0600
Subject: PVDF & microcontrollers - (5)
Message-ID: <CADhsnxcidM4UpaTR4jFb_ZDemD6Bq2hb83sBf2ZLndqcggWwUQ@mail.gmail.com>

it is already established my skills do not allow exploration of
these issues though i have some basic observations to share
about what exists based on web searches that may quicken
research for those interested who are new to PVDF sensors.

first observation is that a development kit exists for those who
have knowledge and interest and want to start experimenting,
[0] though it does not appear to include cantilever hole designs
of the sensor, that was mentioned in terms of tuning antennas.
still, it could be useful for exfiltrating data or capturing signals
sent via infra- or ultrasound, and also has a large film element
that has been used as a speaker in various online demos. for
instance, seemingly you could wire up a PVDF sensor along-
side computer chassis and monitor signals via its vibrations,
or powersupply, perhaps keyboard or keystrokes or whatnot.
likewise, power various tools via energy harvesting of these
same approaches else discover free-energy approach based
in shared resonance not coupled to another material beyond
the antenna itself if tuned to a primary and matched source.

it seems Arduino and other microcontroller platforms are for
those already saavy in programming and they and other such
programmable integrated circuit platforms represent a large
population of developers, professionals, experimenters, and
hobbyists, and other enthusiasts. this seems equivalent in
kind to the early era of electronics with crystal radio kits
occurring in an engineering centric culture that grew into
the early computer industry via ham radio experimenters,
and those who mail ordered and constructed electronic kits,
today involving the internet, online stores, discussion boards
in the realm of advanced computing, everyone having their
own programmable 'computer-based' development platform,
and a tremendous kit of parts to choose from, to further explore.
including ideas, goals, projects, hypotheses, prototypes, etc.

the reason for stating this is that a certain level of literacy may
exist for many who are computer literate in the advanced sense
of a cypherpunks context, knowing hardware and software and
ideas beyond this, into mathematics and linguistic concepts,
and so a high-fidelity understanding and awareness may exist
that enables greater ease of use within the ready-to-program
devices that have limited documentation, and can present a
large learning curve for those starting without such experience.

thus, straight-away to mention that Sparkfun [1] carries various
PVDF sensors, example, that can then be added into whatever
microcontroller may exist capable of interfacing with the sensor.

the thing is, in researching this, it appears there is potentially
limited data for people just starting out, for how to go about this,
whereas those already fluent may know how to put it all together.
apparently instructions can be lacking and this is mentioned with
respect to another approach for those like myself who need more
step-by-step instructions and learning tutorials to know what to
do and how to think about things, to build up awareness via
making circuits on the microcontroller versus using it for an
already determined objective. and there are general kits to do
this for Arduino, in particular a 37 module sensor kit [2], so it
is potentially an experimenter's paradise, if knowing how to get
everything functioning, having a plan and enough information.

i do not know enough about Arduino to know other competitors
in the same domain though it appears there are many others
(Beagleboard, etc) so that was used just as an example of
several different options that exist where these piezo sensors
can be integrated into the existing programmable platform,
to custom-build and craft circuits, as is already being done.

(note: if i am using 'platform' in the wrong way, my apologies,
it is the nearest word i know of to describe these tools)


so essentially it is a 'nothing new here' situation for those who
know all about this technology, though potentially to question
the potential for a piezo film sensor beyond existing boundaries
and perhaps for advanced unmentioned cryptologic applications.

the issue then is to question an electronic component, this
piezo film tab as vibrational cantilever, the piezo element that
exists beyond the circular disk and functions in other territory
and in other configurations, including also piezo coaxial cable
(and again, its potential use as an antenna of other dynamics)


and so, for instance, the datasheets are included on some of
the urls below, to provide more information if interested in
evaluating if the given parameters may allow experimentation
within the realms considered, say detecting signals patterns
via vibrational 'contact' versus acoustic microphone. [3]

so that is perhaps the majority approach for those already
up to speed, though everyone may not have the same approach
or others may want to learn about this, and thus a programmable
microcontroller platform I have successfully learned from before,
both about electronics and software programming of breadboard
circuits is the Parallax BASIC Stamp Activity Kit [4]. essentially
it is a platform for educating people about microcontrollers and
provides an indepth tutorial and various circuits as part of a kit,
and support forums for experimenters and developers, as with
Arduino, which may have its own 'learn electronics' kit, though
it seems Parallax has focused on this educational sector and
providing materials for schoolchildren, hobbyists, and up, to the
professional sector prototyping and development solutions, so
is perhaps unique in its tutorial or hands-on learning approach
versus what may require additional instruction else a different
more self-guided approach otherwise, with other pathways.

(trying to be fair, not advertise, yet also provide information
about the offerings. also: if other PVDF vendors, they are few
or do not have information i could locate in repeated searches)

this is why I mention the Parallax kit that includes a fundamental
course in learning circuits via a programmable breadboard. this
same PVDF sensor [5] can be used with this platform, and it
also has additional data on the commands related to it as part
of a User Guide for that specific tutorial approach, [6] in that it
may provide more structure than other less structured approaches
though perhaps this is more related to the overall framework of
learning to use a microcontroller itself, where for some a more
all encompassing approach may be required prior to interfacing
with the PVDF in terms of programming functioning of a circuit.

and likewise, following this same general theme, the Sensors
Sampler Pack for the Parallax BASIC Stamp microcontroller
includes a PVDF element along with other sensor options. [7]
the reason for providing examples is to see what is out there
for those learning, in individual components and then within an
integrated approach, of which there are various routes to take.

for instance, consider the following project:

Phoenix Ambulatory Blood Pressure Monitor Project
Sub-project: Piezo Film Pulse Sensor
http://www.phoenix.tc-ieee.org/004_Piezo_Film_Blood_Flow_Sensor/Phoenix_PiezoPulse.htm

if someone already knows what they are doing, competent in
the domains of hardware and microcontroller programming, it
would probably be fairly likely they could replicate or learn from
this demonstration of use for a PVDF sensor. yet further, someone
with an interest in cryptography or crytanalysis, could potentially
take this same information and apply the pulse reading to the
chassis of a computer to monitor vibrational activity or apply
this same information in some other way, in terms of security
analysis, exploits, defense, research, exploration, experiment.

though someone who does not have this knowledge then may
be stuck, unless a step-by-step approach exists, which is more
the Parallax approach, and perhaps in some ways Arduinio if
online tutorials exist in place of paper manuals, though these
extra layers of information may be required prior to achieving
such finished projects, and needs to be built-up as a skill first.


but not everything that is involved in this situation is about
technology of computer hardware and software, and the code
can go beyond computing, even 'electrons' potentially, in terms
of what the situation could be modeled as, via its parameters.

in that the PVDF as tunable antenna is not unlike a tuning fork
that is made to resonate by another paired vibration, and while
it may appear this is acoustic energy, air pressure, it could be
the resonance of the material itself that is set to vibrate due to
its physics, its particular construction and composition. that is,
as with Helen Hall and her study of music physics, that what
this involves relates to the issue of a vibrating string, and the
'energy' issues of vibration can be conceptualized likewise in
terms of music principles, such that the resonance as it now
is conceived of may not exist within computing in the way it
is known in music, for instance, yet it may have importance
in terms of harvesting energy via non-acoustic vibrations.

i do not myself understand what this involves enough to better
introduce to topic, though to hh it is 'the Art of Frequencies',
as this relates to music physics and music and energy. the
reason it is mentioned is that sympathetic vibrations occur
in a paired matching or alignment (1:1) and (A=A) in terms
of logic, within my own research, and in this way especially
in terms of 'consciousness', each person their own antenna,
and how they relate to others and in what ways. a common
example could be sexual dynamics and 'magnetic fields', in
that a certain pressure or boundary may be encountered via
anther that either attracts or repels or is perhaps neutral. in
this framework, there is something tied into the materiality
of encounter, the physical body and its relation to another,
other as self or unlike self, as this constitutes circuitry.

further, though, beyond or outside a realm of push & pull
of both magnetic and electromagnetic polarity, it also can
potentially include something 'outside' this EM boundary,
in that a non-electromagnetic energy of vibration could
also exist -- as if in the realm of information itself -- that
maps onto these same connections as 'shared tuning'
(all mention of tuning has origin with HH, in my work).

so what this is to suggest is that this inductive sensing
of humans, this mapping of awareness of self and others,
could be occurring as information in this vibrational way,
if connecting 'dots' across various views and approaches,
and thus how people are tuned or out of tune may relate
to what signals they pick up or what movements they are
part of, as grounded within certain dimensions, dynamics,
self as circuit, then relation with others into groups, etc.

and this is also the PVDF antenna model, seemingly.
potentially. the only substitution i would suggest is that
that 'global electrical current' that could set everything into
a shared time and framework of connected circuitry, would
be in some sense an analogy of empirical truth that flows
into the shared macrocircuit and people are aligned by it.

thus, induction beyond electromagnetism, though also
as a pressure, perhaps, the pneumatic aspect, and the
larger cosmological question of 'strings' that may be of
an informational category, in terms of cosmic vibration
that is defined by resonance of each and every object,
if not mistaken in relaying others knowledge involved.

<insert hilarious cat string-theory cartoon here>

in other words, consciousness could be modeled by
this circuit in terms of information transfer as it also
could have an energetic component yet this approach
could exist outside or beyond the current conception
of the body in both nonexistent electromagnetic terms
and also, non-existence non-electromagnetic terms
functioning outside this electromagnetic framework,
in the sense that aetheric order could exist beneath
the existing dimensional space, this described as a
vortex model of the atom, as it relates to zero. [8]

so the potential, should a vibration on an antenna
transform into harnessing free energy - via resonance
and this new PVDF film sensor technology - then its
significance is also conceptual, beyond perhaps the
issues of creating a vibrating cantilever or pendulum
in a watch that removes the need for a battery or for
winding, due to being tuned to frequency of the earth
that becomes part of its circuit, its power source, via
this connectivity based upon natural order, its circuit
as ecosystem and habitat, context for technology.
and how this moves into modeling of self as a being,
an entity, modeling of information in relation to energy
and matter, in terms of music and physics principles,
and how it recontextualizes questions and parameters
were it to be unlocked as a common framework within
which people relate or decide to disallow its existence

i only saw the first two parts of Atlas Shrugged, a recent
television movie version, never having read the longer book
by Ayn Rand, though it seems to be based upon this same
premise, where another world exists outside the ordinary
realm, having cracked open the threshold allowing access
to other dimensionality. the third part of the film is to be
released in the next summer, apparently. in any case,
interesting times ahead if this is indeed possible...


[0] MSI sensors - 1004308 Piezo Film Sensors Basic Design Kit
http://www.digikey.com/catalog/en/partgroup/piezo-film-sensors-basic-design-kit/22080

[1] Sparkfun -- Piezo Vibration Sensor - Large
https://www.sparkfun.com/products/9196

Piezo Vibration Sensor - Large with Mass
https://www.sparkfun.com/products/9197
https://www.sparkfun.com/products/9198
https://www.sparkfun.com/products/9199

[2] SunFounder - 37 Modules Sensor Kit
http://www.amazon.com/SunFounder-modules-Arduino-Mega2560-Mega328/dp/B00CBDUD60/

[3] example datasheet
http://dlnmh9ip6v2uc.cloudfront.net/datasheets/Sensors/ForceFlex/LDT_Series.pdf

[4]  BASIC Stamp Activity Kit - USB (Text v3.0)
http://www.parallax.com/product/90005

[5] ex. info: Piezo Film Vibration Sensor Tab
http://microcontrollershop.com/product_info.php?products_id=4989

[6] Piezo Film Vibra Tab User Manual
http://pub.ucpros.com/download/605-00004-PiezoFilm_V1.1.pdf?osCsid=ecd6b5ifdp3gn6j61tbarraqb3

[7] Sensor Sampler Pack
http://www.parallax.com/product/28028

[8] Art of Frequencies - Helen Hall
http://artoffrequencies.wordpress.com/


intercalate, communication gap, pulse-jet




From dan at geer.org  Thu Dec 19 17:35:36 2013
From: dan at geer.org (dan at geer.org)
Date: Thu, 19 Dec 2013 20:35:36 -0500
Subject: [cryptography] NIST Randomness Beacon
In-Reply-To: Your message of "Tue, 12 Nov 2013 11:12:10 EST."
 <20131112161210.GB6338@petertodd.org>
Message-ID: <20131220013536.F37722280E0@palinka.tinho.net>


After all that discussion of the randomness beacon, it belatedly
occurs to me to ask if anyone has ever applied, even for fun, any
of the various tests for randomness to the transmissions from the
various shortwave "numbers stations."

http://en.wikipedia.org/wiki/Numbers_station


--dan




From coderman at gmail.com  Fri Dec 20 04:32:33 2013
From: coderman at gmail.com (coderman)
Date: Fri, 20 Dec 2013 04:32:33 -0800
Subject: [Full-disclosure] RDRAND used directly when default engines
 loaded in openssl-1.0.1-beta1 through openssl-1.0.1e
In-Reply-To: <CAJVRA1St=tXDdv59Ya7TQjWFyrCiCWH4GySgGLoQxm3ZLduwag@mail.gmail.com>
References: <CAJVRA1RZJgO2wOKsY8pMxnwpHPnLgx9DiW4_1CzxotT==f3rFw@mail.gmail.com>
 <CAJVRA1St=tXDdv59Ya7TQjWFyrCiCWH4GySgGLoQxm3ZLduwag@mail.gmail.com>
Message-ID: <CAJVRA1RbpJWtaU0i87BOqXzNcrMDe+uzEsJFGxOe5x=4b3e+Fg@mail.gmail.com>

On Mon, Dec 16, 2013 at 7:27 PM, coderman <coderman at gmail.com> wrote:
> ...
> "what is affected??"

fortunately impacts are less than anticipated!

nickm devised most concise fix: RAND_set_rand_method(RAND_SSLeay());
 always after ENGINE_load_builtin_engines().
https://gitweb.torproject.org/tor.git/commitdiff/7b87003957530427eadce36ed03b4645b481a335

---

full write up is here including a BADRAND engine patch for testing:
  https://peertech.org/goodrand

---

last but not least, notable omissions on NSA role in reqs for random
number sources in Appendix E: US Government Role in Current Encryption
Standards.:
  http://cryptome.org/2013/12/nsa-usg-crypto-role.pdf

can we get a do-over?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




From electromagnetize at gmail.com  Fri Dec 20 10:21:06 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Fri, 20 Dec 2013 12:21:06 -0600
Subject: energy harvesting via PVDF - (02)
In-Reply-To: <12066908-0f1d-4292-a684-2bbfa0f888a1@email.android.com>
References: <CADhsnxfzfh7pvOnuXsCfs1kuiPwu-inaFNiW9E12Bnnd5BNfvw@mail.gmail.com>
 <12066908-0f1d-4292-a684-2bbfa0f888a1@email.android.com>
Message-ID: <CADhsnxfpHtwrF9GFOpsboecrWLrph5CKnpT25DOtT2cx_QP+Rg@mail.gmail.com>

excellent point- i will be posting a follow-up section on troubleshooting
with another strategy related to this and more information. thanks

<krugar at krugar.info> wrote:

> you'd need an awefully large piezo sheet/drumskin to resonate at 8Hz, and
> i'm guessing the energy of that ambient infrasound rumble you try to tap
> into is so low that in most settings you'd be a lot better off by just using
> a solar panel of the same size.




From bill.stewart at pobox.com  Fri Dec 20 13:24:18 2013
From: bill.stewart at pobox.com (Bill Stewart)
Date: Fri, 20 Dec 2013 13:24:18 -0800
Subject: request for transcript: Bruce Schneier and Eben Moglen
 discuss a post-Snowden Internet
In-Reply-To: <1387181876.85394.YahooMailNeo@web141203.mail.bf1.yahoo.com
 >
References: <CAJVRA1Qk5=w1xaVjxcazZwSa6x_A9tQvpHRwbCsBGxEm-dLbhg@mail.gmail.com>
 <D50675A0542A41A22C2AB7B0@F74D39FA044AA309EAEA14B9>
 <etPan.52ae6d0a.643c9869.119c@Al-Retina.local>
 <0BA46A74C48582AEC56F8515@F74D39FA044AA309EAEA14B9>
 <etPan.52ae729a.66334873.119c@Al-Retina.local>
 <2747B59FB663E23517A4AE53@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7817.19495cff.119c@Al-Retina.local>
 <B382834E9F9D0C0D3022CDB5@F74D39FA044AA309EAEA14B9>
 <etPan.52ae7ae0.2ae8944a.119c@Al-Retina.local>
 <20131216042120.87F4CFC01@a-pb-sasl-quonix.pobox.com>
 <1387181876.85394.YahooMailNeo@web141203.mail.bf1.yahoo.com>
Message-ID: <20131220212429.75215F9B1@a-pb-sasl-quonix.pobox.com>

At 12:17 AM 12/16/2013, Jim Bell wrote:
>Thanks for reminding me.  Did the list ever find out who Detweiler 
>was?  Sorry for asking, but I've been .... away.

Detweiler really was just this guy (though I seem to remember some 
discussion about him being a twin, which could account for a bit of 
his obsession with identity.)  We did once have a guy show up at a 
Bay Area Cypherpunks meeting who introduced himself as "Lawrence from 
Boulder".  I thought that was amusing but didn't say anything; he 
left midway through, and after the meeting Eric Hughes suddenly 
noticed "Hey, wait a minute!  Lawrence from Boulder?!?!?"




From krugar at krugar.info  Fri Dec 20 08:29:19 2013
From: krugar at krugar.info (krugar at krugar.info)
Date: Fri, 20 Dec 2013 17:29:19 +0100
Subject: energy harvesting via PVDF - (02)
In-Reply-To: <CADhsnxfzfh7pvOnuXsCfs1kuiPwu-inaFNiW9E12Bnnd5BNfvw@mail.gmail.com>
References: <CADhsnxfzfh7pvOnuXsCfs1kuiPwu-inaFNiW9E12Bnnd5BNfvw@mail.gmail.com>
Message-ID: <12066908-0f1d-4292-a684-2bbfa0f888a1@email.android.com>

you'd need an awefully large piezo sheet/drumskin to resonate at 8Hz, and i'm guessing the energy of that ambient infrasound rumble you try to tap into is so low that in most settings you'd be a lot better off by just using a solar panel of the same size.


brian carroll <electromagnetize at gmail.com> wrote:
>okay, so the big surprise for me was that this piezo film
>technology lines up directly with an energy harvesting
>article from a recent (urls) list. excerpted again below:
>---------------------------------------------------------------------------
>
>// contact electrification using patterned nanomaterials...
>// note: the gap, equilbrium via chargeflow, as if via entropy.
>// discovery originating from malfunctioning piezo-sensor...
>
>Capturing wasted electricity with triboelectric generators
>http://phys.org/news/2013-12-capturing-electricity-triboelectric.html
>
>[quote] "Beyond generating power, the technology could also provide a
>new type of self-powered sensor, allowing detection of vibrations,
>motion, water leaks, explosions – or even rain falling." ... "They
>have learned to increase the {power output density by a factor of
>100,000} by applying micron-scale patterns to the polymer sheets. The
>patterning effectively increases the contact area and thereby
>increases the effectiveness of the charge transfer." [unquote]
>
>---------------------------------------------------------------------------
>
>from what i have read about PVDF, it would seem possible
>that a similar nanopatterning could be etched onto the piezo
>film surface that is bending or strained, and via this more
>intense grid or array it may be possible to likewise up the
>capacitance or charge that can be held and stored within
>piezo film, (patterns like a step-up-transformer perhaps),
>based on the above, if indeed a non-piezo film investigation.
>
>the characteristics appear identical: LEDs need enough
>voltage to light, and a constant current to maintain lit, and
>thus the high voltage of material difference or 'gap' in the
>original news story (linked above) indicates that a high
>voltage is _momentarily transferred that is enough to
>light up an array of LEDs, though only for an instant.
>and this becomes an application for energy harvesting.
>
>so it should be notable if the PVDF film also shares these
>properties, that it generates a high voltage that can be sent
>into a circuit, though likewise it is a momentary not constant
>charge and thus particular circuits would need to be designed
>to allow it to function as a source of energy for a self-sustaining
>circuit (energy harvesting) rather than just pushing out current,
>unless somehow it was possible to get it moving in that way...
>
>i.e. constant vibration -> high voltage -> constant AC current
>
>(these observations from someone who knows nothing about
>these things, beyond trying to understand the fundamentals
>of basic electronics components and their functioning. yet
>enough to ask questions and make a few assumptions...)
>
>so it appears to be an issue of a trickle-charge circuit, that
>the PVDF film would vibrate and offload that current into a
>another capacitor where it could be stored until a usable
>amount and then accessed for low-power functionality of
>some super-efficient circuit design, PVDF the powersource.
>
>so for this trickle charge circuit, it is imagined:
>
>  PVDF film --> diode --> supercapacitor --> "circuit"
>
>whereby 'vibrational energy' is powering the overall circuit,
>which in crypto or security terms could be sensing-related
>or monitoring or sniffing data via low-power and stealth, etc.
>or perhaps even transmitting information or code or relaying
>or capturing infrasound data, where vibration both provides
>power to the circuit and information (high metaphysics)
>
>from what i have read, the current is AC from the piezo film,
>and then another capacitor would turn it into DC if this is not
>mistaken, for use in such a circuit- this only an approximation
>of what the most basic issues might involve, if also incorrect
>though i figure many here have the information and knowledge
>to resolve such issues if inquiring further, thus; 'about ideas'
>
>
>so at this stage, as with everything: things start to get weird...
>
>perhaps it is because of my lack of knowledge or involves some
>basic misunderstanding that i am simply incapable of realizing;
>though this little electronic component is essentially some kind
>of strange antenna device, and if it can be made to vibrate then
>it generates power; so if it constantly vibrates, it constantly is
>able to generate current and thus replaces a battery in a circuit
>
>so to get usable current, the key is to either trickle charge and
>build up and store energy over time, to a point that it can be
>used at normal levels, or to generate a frenzy of energy via
>constant activity that strains the PVDF film, creating a flow
>of alternating current that can be immediately turned to DC
>as powersource, and thus 'live power' vs. a delayed approach
>
>(maybe oversimplifying or confusing the electronics issues
>or paradigms involved, though this is how i am relating to it)
>
>why does it matter?
>
>well, from what i understand after listening to my friend who
>is a composer, making a film on a Nikola Tesla, whose studies
>and research focuses on 'music as an energy system', [0] [1]
>also in relation to my own investigations of logic (A=A) as this
>relates to her study of tuning systems and "resonance-based
>energy transfer" (somewhat in the range of wireless power, yet
>non-electromagnetic, involving vibrations, not moving of charge)-
>
>if there were a vibration that existed that could be tapped into
>by this PVDF piezo film -as antenna- and it could be made to
>vibrate constantly, then *bingo* -- it is access to free-energy
>
>and i am only thinking these specific thoughts because of hh,
>and would be nowhere in this vicinity with my own investigations
>which tend more towards the HIOX model though interest of this
>realm of electronics is extreme at the same time as my illiteracy
>and incapacity, thus words must substitute for actual experiment.
>
>and so piecing it together- under such guidance, it is verified by
>others who are expert that this constant vibration exists within
>the environment already, today, now, and for billions of years
>presumably. it was investigated by Nikola Tesla, where the
>area between the ground of earth and the dome of sky in its
>upper atmosphere create a waveguide or sorts, known as
>the "Earth-ionosphere cavity" [2], which in turn generates a
>vibrational frequency known as the Schumann Resonance [3]
>that provides a source of constant vibration at 7.83 Hz resulting
>from lightning strikes in the atmosphere which then creates this
>giant battery in the sky, that in turn could be tapped into, both
>in non-electromagnetic terms, via vibration, and likely as with
>lightning, electromagnetic terms, as a source of power.
>
>so it cannot be this easy, right. gotta be missing something.
>and if i could design the circuit and figure it, i would know, and
>yet i cannot and so share my puzzlement, inquiring: why not?
>what am i missing, what do i fail to understand of the situation?
>
>
>in other words, if you can get the PVDF film vibrating by tuning
>into the 7.83 Hz frequency of the Schumann Resonance, you
>would have access a local instance of perpetual motion, as long
>as the dynamics retain the existing characteristics, indefinitely
>
>continued...
>
>
>0. helen hall - composer, filmmaker
>http://www.helenhall.net
>
>1. Pictures of Infinity -- film about Tesla & aether
>http://picturesofinfinity.net/
>
>2. Earth-ionosphere cavity (diagrams)
>http://www.glcoherence.org/templates/gcp/images/monitoring_system/earth_rhythms/diagram_schumann_resonances_ionosphere_cavity.jpg
>http://www.vlf.it/Schumann/cavity.gif
>
>3. Schumann resonances
>http://en.wikipedia.org/wiki/Schumann_resonances
>
>
>oratorio, amaryllis, Teller

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 9300 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131220/c2b11c6d/attachment.txt>

From coderman at gmail.com  Fri Dec 20 17:41:36 2013
From: coderman at gmail.com (coderman)
Date: Fri, 20 Dec 2013 17:41:36 -0800
Subject: NSA holiday talking points humor
Message-ID: <CAJVRA1R5idvt5RwoiqDBWnteyP=bCJYkXvR_e4r5pR0-wR0doA@mail.gmail.com>

this is pretty amusing reading:
  http://s3.documentcloud.org/documents/844508/nsas-talking-points-for-holiday-gatherings.pdf


"NSA does not and will not demand changes by any vendor to any
product, nor does it have any authority to demand such changes." - NSA
Spin

TRANSLATION:
"We pay above market rates[0] to our corporate partners for embedded
vulns goddamnit!" - NSA Truth


0.  $10,000,000 to backdoor all of RSA's BSafe customers and cheer
lead Dual_EC_DRBG through approval it seems.
 http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220

let's not get into the standards bodies[1] yet, they're a little raw
right now :o


1. "Critics: NSA agent co-chairing key crypto standards body [IETF
CFRG] should be removed"
  http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/




From coderman at gmail.com  Fri Dec 20 18:43:16 2013
From: coderman at gmail.com (coderman)
Date: Fri, 20 Dec 2013 18:43:16 -0800
Subject: [cryptography] Vegetation Comsec
In-Reply-To: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
References: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
Message-ID: <CAJVRA1RwSb16RND5hMe=fbskQFaMU2JsTf8Cm-2hYDmdss2xug@mail.gmail.com>

On Fri, Dec 20, 2013 at 6:22 PM, John Young <jya at pipeline.com> wrote:
> ...
> Plant signaling with chemical emissions was intriguing, as were
> signals sent through proxies such as insects.
> ...
> Has anyone seen reports on this? Or on chemical transceiving
> for comsec? Public key as a plant with unique biological
> identity which absorbs or emits decrypt signal? The use of insect
> and chemical proxies?


most stylishly done as 'the drummers':
"""
  where he is taken in by a strange society known as “The Drummers”.
These people operate in underwater compounds located off the coasts of
major centers, perform rhythmic, hypnotic dances and engage in
ritualized sex. This act, we learn later, is actually for the sake of
information exchange, which is done through the transmission of
nanomachines contained within their bodily fluids.
"""
 - http://storiesbywilliams.com/2011/11/25/the-diamond-age/


more recently via vodka emission:
"""
scientists used a desk fan and mist of alcohol to transmit evaporated
molecules that were translated into binary signals and decoded by a
breathalyzer device.
"""
- http://www.ibtimes.com/worlds-first-text-message-sent-using-vodka-new-technology-transmits-binary-signals-molecules-photos
[this technique can be generalized to any gaseous emission (or aqueous
when at sea?) with appropriate detector.]


and of course, chemical signalling is not magically immune to flaws;
ant mills (death spirals) one of many examples of signalling amiss.


and there are some interesting research papers on targeted genomic
viral strains which only "unlock" to a very specific genetic profile.
i don't have them handy...




From jya at pipeline.com  Fri Dec 20 18:22:40 2013
From: jya at pipeline.com (John Young)
Date: Fri, 20 Dec 2013 21:22:40 -0500
Subject: Vegetation Comsec
Message-ID: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>

Proceeding with novel comsec investigations, the New Yorker
this week has an article on plant communication and intelligence
and how they differ from those of animals.

http://www.newyorker.com/reporting/2013/12/23/131223fa_fact_pollan

Plant signaling with chemical emissions was intriguing, as were
signals sent through proxies such as insects.

Plant perception of hazards, sensing sources of water, light,
air, nutrients, kin, enemies is suggestive for veggie comsec.

And all this is based on being tethered to the ground, immobile
thus having to do what animals do by different means, barely
perceptible to animals, slow moving, but effective in competing
with other plants as well as animals.

Darwin wrote the seminal work, but current scientists are
deeply involved in what some call "neurobiology" in which
brain-like activites are accomplished by vegetable swarms
of signals and networks without animal brains. Albeit root
stems searching for water and nutrients appear to behave
like brains below ground, while veggie sex occurs above
ground.

This raises the prospect of using plant capabilities in
emissions of chemicals and finding nutrients in signaling,
SIGINT, comsec, infosec and crypto.

Has anyone seen reports on this? Or on chemical transceiving
for comsec? Public key as a plant with unique biological
identity which absorbs or emits decrypt signal? The use of insect
and chemical proxies?

An amusing account is that of a CIA polygrapher claiming
to exchage signals with plants, discovered by hooking up
a polygraph to them. He said he could just think of burning
a nearby plant for the plant to initiate defenses. His claims were
later discounted but remind of the long-running mind control
research by US and Russia. And the unkillable kudzu of
lie detectors.





From electromagnetize at gmail.com  Fri Dec 20 19:49:15 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Fri, 20 Dec 2013 21:49:15 -0600
Subject: PVDF strategies - (06)
Message-ID: <CADhsnxcE_ifBgSHh4txg=Y6L2rN3cYcJBLBmtp-zqNakG2Od=w@mail.gmail.com>

a general situation and condition has been described,
relating piezo film (PVDF) with issues of free energy
and also 'non-electromagnetic' if not 'non-acoustic'
transfer of power and perhaps information likewise.

yet there is a problem encountered as mentioned,
regarding challenges to achieving an ~8 Hz vibration
at the given scale, which may be an issue connected
with do-it-yourself approaches versus a manufacturing
approach, and the technological tools and equipment
available to investigate these dynamics at the scale
of breadboards, microcontrollers, and PVDF elements.

can the existing 'size' of an PVDF electronic component
actually register the approximate ~8 Hz vibration of the
Schumann resonance?

from what i have read in the technical manual (p.2), the
piezo film material is capable of registering vibration at
this frequency [1] and in fact is so sensitive in its use
as in contact microphone applications that shielding is
required to reduce unwanted vibrations [2] in a context
of 'vibration sensing' which also applies when attached
to music instruments [3]. with this in mind, it appears
that the PVDF film element is hypersensitive to any
vibration depending on the surface it is attached to.

in other words, if there is an ~8 Hz vibration occurring,
it would seem likely if not probable that the PVDF film
tab is potentially capable of sending it, given enough
knowledge and whatever equipment required to do so.

so enough of the hypotheticals, i may have forgotten
to emphasize if not mention an important observation.

several weeks ago there was an (urls) list sent that
had information about a NOVA science program that
just aired on Public Television (PBS) in the U.S. and
i saw the last 20 minutes or so of that show, as was
conveyed on that post. [4] [5] the expert interviewed
for the program, Earle R. Williams [6] mentioned the
Global AC Circuit and described research occurring
in a rural Rhode Island experiment that has been
studying this for decades, based on groundbreaking
ideas of a previous researcher who pioneered the field
of atmospheric electricity.

and what Mr. Williams said and demonstrated in this
interview was astonishing to hear. basically, if memory
serves: any antenna on earth picks up this frequency
of the Schumann resonance, which he said was ~8 Hz.

(presumably equates to 'metal antennas' i am guessing,
of the kind found on radios and televisions.)

the very interesting aspect about this, 'context' as it were,
is that this research hut for atmospheric electricity was
old technology -- basically an antenna in a very remote area
to minimize electromagnetic interference (EMI) from what is
the buzzing infrastructure of wired and wireless civilization.

the other aspect is that Mr. Williams stated, if remembering,
that all that is needed is an antenna and oscilloscope to
verify the signal is there. meaning: get a metal antenna,
have it grounded or whatever is necessary, and then attach
it to a visual feedback system and locate the 8 Hz signal.

"spikes" that occur within the signal, atop the frequency
of the Schumann resonance, are lightning strikes. as if
the earth-ionosphere cavity may have some aspect of an
echo chamber (my phrasing), though also it was stated,
again, if remembering correctly, that lighting strikes can
travel up to 2.5 times around the earth, which feeds this
resonance and supports and sustains this wavelength
that is vibrating on all antennas everywhere the same.

so in some sense these are clues, signs of what exists,
what the parameters are. people who know how to use
an oscilloscope and basic antenna are that much closer
to the issue than those who do not, and likewise, those
who can program a microcontroller and write code, etc.


so incorporating this as additional information into the
existing approach and ideas, along with helpful feedback
that questions the starting investigation in its parameters,
it seems possible that experimentation could begin within
a PVDF film sensor context, if having the tools, technology,
and ideas to shape and evaluate and test these conditions.
though further, it is also probable that specifically designing
a PVDF sensor for this particular application would be the
more direct investigation. both approaches could be viable.


in other words, the as-is approach relying on existing
piezo sensors could yield some interesting and unexpected
discoveries, and perhaps break this open into another realm.

and so how to do that is a question: how to tune the element,
how to approach it, what are the actual issues involved, etc.

for instance, consider the PVDF film itself as a rectangle
that can register vibrations via touching a vibrating surface;
this versus having the PVDF film itself resonate, vibrating
based on its being a quasi free-standing antenna. these
different approaches both could potentially access 8 Hz
though via different strategies and frameworks.

my assumption is is that rectangle of the sensor itself
is capable of picking up 'multiple frequencies' at a given
time, depending on what exists as a signal. and thus, if
in a musical approach, it may have 'multiple tunings' even
that coexist on the vibrating surface, whether freestanding
or registering movement from an attached vibrating surface.

and so the issue can be of filtering these signals to focus
the sensor into a given range. and how this is done could
effect its 'efficiency' in terms of energy collection, because
a stronger versus weaker signal could exist, if muddled by
others that counteract its pendulum-like wave movement. if
this way, dampening of the vibration via weights may allow
no movement in certain frequencies, whereas a software
filter could only edit them out while they still exist as an
active force, perhaps removing energy from or competing
with a given frequency or signal from the wanted range.\

so capturing different frequencies simultaneously (good
for crypto and energy harvesting, perhaps) vs. focusing on
a given range (better for Schumann resonance seemingly)

and yet here's the thing--

like a drum skin, how is this elusive jabberwocky of the
Schumann resonance of ~8 Hz ever going to be accessed
if it cannot be readily encountered. what can capture that
wave vibration, at that particular very long wavelength. and
(due to no memory, i get to ask such rhetorical questions)
this is what triggered my memory about the antennas, that
all antennas vibrate at this frequency, or so the expert said.

though also, considering the drum approach, this then got
me thinking- instead of a free standing 'energy antenna',
would it not be possible to use a PVDF sensor to measure
and also pick up this 8 Hz vibration on an antenna instead?

in that if the antenna is vibrating at 8 Hz, could this vibration
be 'harvested' and establish mechanical vibration in these
highly sensitive piezo films, to then build up AC current in
via their capacitance, building up and storing this charge...

in other words: PVDF + ~8 Hz antenna freq. => energy


if there were no limits to exploration and equipment could
be used to custom manufacture prototypes for this purpose,
what would an antenna look like that vibrates only at this
targeted frequency... and thus, another strategy could
involve custom manufacture of the piezo film element,
such that its surface has an antenna etched onto it,
that is made to vibrate at the Schumann resonance,
for instance a particular geometry, grid, array, pattern.

i have read about antennas and they are based upon
geometric proportion to the wavelength, so 'size' does
not necessarily correlate to frequency in terms of larger
antennas for bigger wavelengths, (if i am not mistaken).

instead, the issue of alignment between a signal and
an antenna involves a matched or paired geometrical
structure that can effectively map signals onto antennas
and then coherently deliver this signal into a circuit. likely
as cleanly and crisply as is possible, mathematics then
determining these models and design approaches. thus,
fractal antennas are an area where 'scale' is exampled
other than a yagi or dipole. and cellphones in particular
appear to make very tiny antennas or utilize unique
approaches to make them invisible even, via how the
device is grounded and where the wires are hidden,
perhaps related to signal strength and also 'length'.

so in some sense, maybe size and scale do matter
and in some sense maybe size and scale are not the
most critical factors in given applications. maybe a
larger power source requires a larger antenna and
smaller applications only need smaller antennas.


what i want to convey is that this 'etched on' approach
where an antenna structure could be engineered onto
the piezo film surface -- (such that it would vibrate at
the given frequency and then stress the sensor, in
turn generating power via its constant movement) --
has correlation with a circuit - perhaps soldertrace,
that is the antenna. so imagine a rectangle with a
single loop of a given geometry that would somehow
function as a single-frequency antenna and vibrate,
and thus stress/strain, compression/decompression
of that metal structure would flex the piezo film that
it is attached to, and be designed to maximize the
surface area with this specific tuned geometry that
can focus in on just those signals or vibrations, as
simple as an anode and cathode attached to it, yet
if correlating other approaches, perhaps etched to
a nanosurface-level with fractal patterns even that
could maximize voltage, if possible, or increase
capacitance or whatever else may be optimized
for energy harvesting of ~8 Hz signal vibrations.


so, to simplify, imagine 'the cantilever' that is the
concept already for the piezo film tab, a rectangle
that moves back and forth on axis, and in doing so
creates and stores charge that then can be dumped
into a circuit, bit by bit if momentary, and seemingly
constant alternating current if the signal is constant.

the additional etched pattern atop the sensor, this
being an additional layer, could be considered 'the
antenna' for accessing Schumann resonance. yet,
it could also be conceptualized as a cantilever that
is in addition to the piezo device itself, also this.

my vagueness here is not intentional, trying to write
into a particular direction and context whereby this
'tuned antenna' atop a cantilever instead becomes
this cantilever via a different manufacturing process,
whereby the PVDF device is itself tuned to ~8 Hz,
& moreso, perhaps taking on the form of cantilever.
such that, the piezo elemen becomes a tuning fork
that is tuned for this specific vibrational frequency,
and then anode/cathode, into associated circuitry

precedent, and note 'the scale' here, is with MEMs
devices and micromachines and nanoscale devices
where such extreme miniature 'antennas' can already
be constructed and vibrate at known frequencies, and
they take on the form of a cantilever (same functioning
as energy harvesting sensors, as vibrating pendulums)
and thus micro and nano radios can be made and
other devices, where under microscope a furious
activity is observed of what is basically a tuning fork
that is naturally vibrating via its 'tuned resonance',
(if not mistaken in interpretation of these events).

so at this unobservable visual scale, little cantilevers
can be made to vibrate via their tuning, and function
essentially the same as cantilevers that at this scale
are not envisioned or conceptualized to auto-vibrate
via paired resonance. why is that i wonder, (embargo
on thoughts, experiment, or secret domain perhaps)

just consider a watch, the mechanisms required to
wind and keep the watch spinning its intricate gears,
as this relates to pendulum movement. now what if
a cantilever existed that could vibrate automatically
at ~8 Hz, and thus no more batteries, solar cell, nor
wind-up mechanisms would be needed to provide the
motive power need for its clockwork movement. and
in this way, likewise- the cantilever is the antenna.

the concept of the sensor as mechanical cantilever
in its multiuse form, instead being reimagined as a
tuned rectangle with additional layer of antenna, this
as cantilever, or further, no rectangle and instead the
PVDF is made into a cantilever, tuning fork vibrating
at the frequency of the Schumann resonance, and in
this way, potentially replacing batteries given the size
of the cantilever and its effectiveness or efficiency.


another way to consider this in terms of electronics
and circuits is the (radio again) crystal oscillator that
is included as a stand-alone timing device, matched to
a particular frequency, lets say ~8 Hz for example...

as i understand it, electrical current in a circuit - say
involving resistors, capacitors, relays, switches, and
wires on a prototyping breadboard - moves throughout
this maze of components and can send electrons into
the crystal oscillator, a timing device, that is activated
by this electricity and generates a particular frequency
in response to its being electrified, formatting resulting
output as a given frequency, here 8 Hz, back into the
circuit, where it could be used say by an IC chip that
uses it to count cycles that trigger other activity, say
an LED display that moves up a number every million
cycles and continually counts 0-9 and starts over again.

so the idea here is that this electronics component is
partly doing what the PVDF sensor is, only in reverse.

what the crystal "quartz" oscillator does is vibrate at
a particular frequency (~8 Hz) which is the goal, and
this is already achieved in a device related in some
way already to piezo sensors (see: quartz). the main
difference is that it requires external energy to generate
the signal or the vibrations, (though if it were tuned to
~8 hz, might it vibrate without any external power?)...


     energy (in) ==> crystal oscillator ==> 8 Hz vibration (out)


to put it another way, in terms of active concepts...


     electricity ==> vibration ==> timing


in other words, in traditional radio or other timing circuits
reliant upon crystal oscillators, electrical current (power)
is input into the component that then "vibrates" at a given
frequency, and then this signal is output as 'time' into the
circuit, whereby the electrical current has this geometric
patterning mapped into its structure which is then utilized
by related or connected components, to format other action.


what the piezo film sensor does is exactly the opposite:


    timing ==> vibration ==> electricity


it takes some regular mechanical vibration when attached
to a surface, and this vibration strains the sensor which in
turn generates electrical charge via piezo electric properties
and then stores this charge via its capacitance, which then
can be output into the connected circuitry as AC electrical
current. the main issue appears to focus upon controlling
the timing or frequency, via TUNING the device (that is,
creating a cantilever or antenna to automatically vibrate)


in other words, if the 'timing' between the PVDF or other
piezo sensor and the Schumann resonance could be
established, matched in shared resonance (A=A) such
that the 8 Hz signal would directly map to an antenna
or cantilever structure tuned specifically for 8 Hz, then:


    matched-timing ==> perpetual vibration ==> free electricity


where 'matched-timing' is pairing of signal with antenna
of the piezo sensor (cantilever or not) in that the geometry
is aligned (A=A) which then accesses and sustains this
connection of 8 Hz vibration via 'shared resonance' that is
a transfer of energy from the earth/ionosphere cavity, to
the surface of the earth. the critical issue appears to be
~adjustable tuning of an antenna to allow for drift, such
that "tuning" differences both small (Aa=Ab) and large
(A=B) can be adjusted for, which also occurs in a realm
of electronics and watchmaking, if not mistaken, that an
additional level of fine-tuning and adjustkbility is involved
and required in such intricate small scale technological
if other ecosystems, because variances may exist/persist


does this mean also that a crystal oscillator [7] is a step
or two away from providing power to a circuit if only tuned
to ~8 Hz - it would probably involve whatever piezo aspect
of crystals, if they could output current as piezo sensors,
when vibrating at this frequency, thus an issue of locating
or manufacturing such crystals, tuning them as antennas.

(should Superman be mentioned here, or metaphysics of
crystals, predecessor to electronics, original components
of nature, such that this is the foundation of the study, in
this way, so too amber and lodestone, known or unknown)


the key idea then is of tuning piezos, whereby the piezo
element is itself the antenna, and this could be explored
in various ways, etched onto the surface of an existing
sensor element, such as with PVDF film tabs, or made
into a cantilever such as a tuning fork vibrating at ~8 Hz
that outputs energy into a self via its perpetual motion,
and further, crystal oscillators tuned to this frequency
of the Schumann resonance, if capable of generating or
outputting electricity via alignment with this frequency,
tuned into it in terms of energy harvesting versus timing
for circuits or for receiving or transmitting radio waves.

note: again, this is non-electromagnetic vibration that
is accessed, so oscillators and piezos are functioning
in an undescribed realm at macroscale, though within
effects _known within music (as natural philosophy),
described by composer/filmmaker Helen Hall. [8]

the mythos involved includes a realm of the forbidden
and of the fringe activity of outlawed energy research,
access to 'free energy' that is believed to have earlier
been accessed on earth by its inhabitants yet since
disappeared within civilization, vanished along with
its cosmology (of the aether), the plenum seemingly,
edited out, removed from view via Michelson-Morley.

and yet the idea of limitless energy, locating it as if an
issue of dousing within the electromagnetic framework
with various strange machines and contraptions, those
seeking to tap into it, upon relating to and realizing its
mystery that surrounds, encompasses, defines and yet
cannot be tangibly defined in these same terms it exists
because the basic model and approach are off, and just
enough to send things in another direction, still unaware

in other words, there is potential energy all around, the
issues of dead cellphones after 5 hours moot should a
small cantilever antenna find geometrical alignment that
replaces its power source with one non-electromagnetic,
non-polluting, attuned to nature and mind, in harmony
and related to the larger order, not existing to destroy it.

how to tap into it, where is it. how do you get there if
electromagnetism is off-limits to investigation beyond
an ideology of a protective technological priesthood.
and then, how to imagine beyond electromagnetism
if concepts are not understanding of this condition
firstly, to realize what the encountered issues are,
so that reasoning is possible in a shared framework

the larger question, how to tap into the infinity that is
within the electromagnetic circuit, open up that seam
between zero and infinity, and use it to turn things at
higher speeds and momentums or with greater force,
limitless power of any magnitude, seemingly. this is
essentially to break out of relativity and back into a
non-warped model of nature, so anti-gravity and other
such issues are basic and easy to advance beyond,
though if living within lies of a false perspective this is
not possible. so the worldview has to be taken down
before any landspeeders are going to arrive in town

-=--

0. The 8 Hertz approximation was used by an expert on
this issue, which is an easy round number to recall that
stands-in for whatever the exact decimal place resonance
may be for hooking up to the Schumann resonance. This
expert was on a NOVA public television program who will
be referenced in this text, and whose information follows...


1. Measurement Specialties PVDF technical manual (PDF)
http://contactmicrophones.com/techman.pdf

quote: Wide frequency range—0.001 Hz to 10^9 Hz

2. Cold Gold - Contact Microphones
http://contactmicrophones.com/

"These film tabs usually need to be shielded
{by copper shielding tape} to reduce hum."

3. technical manual, p.47

4. light-signals (urls)
https://cpunks.org//pipermail/cypherpunks/2013-November/002201.html

5. NOVA: At the Edge of Space  (PBS science program)
http://www.pbs.org/wgbh/nova/earth/edge-of-space.html

6. Earle R. Williams -- Research Overview
http://web.mit.edu/earlerw/www/Research.html

7. Crystal oscillator
http://en.wikipedia.org/wiki/Crystal_oscillator

(note: crystals as tuning forks)

8. Helen Hall - Art of Frequencies
http://artoffrequencies.wordpress.com/

-- addenda: i forget another obvious and ubiquitous microcontroller
platform, raspberry pi. should have included it as a main example --


{educational fair-use of copyright, 2013}

raedi  staedi  6⁰




From electromagnetize at gmail.com  Fri Dec 20 20:15:55 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Fri, 20 Dec 2013 22:15:55 -0600
Subject: Vegetation Comsec
In-Reply-To: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
References: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
Message-ID: <CADhsnxdf+vxHBTMTK89BG1=wkepSUSpuntrN40CTt1vi=PPWrQ@mail.gmail.com>

[video] Cleve Baxter - Plants can sense human intentions
https://www.youtube.com/watch?v=Ntv4ZMvUSWI


(information as non-electromagnetic tuning/induction;
 informational circuits related to grounded truth/logic)




From rdohm321 at gmail.com  Fri Dec 20 14:43:43 2013
From: rdohm321 at gmail.com (Randolph)
Date: Fri, 20 Dec 2013 23:43:43 +0100
Subject: Fwd: Whitepaper for Crypto-Torrents
Message-ID: <CAEvNM8=Wf2wRYj2+9WcWtYvp7FmwZ8_P9a3X=B2B3a93bZsExw@mail.gmail.com>

http://sourceforge.net/projects/goldbug/files/goldbug-im_0.7._RELEASE/GoldBug_%20Secure_Instant_Messenger_Manual_07.pdf/download
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 298 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131220/3ac072b8/attachment.txt>

From gwen at cypherpunks.to  Sat Dec 21 02:10:44 2013
From: gwen at cypherpunks.to (gwen hastings)
Date: Sat, 21 Dec 2013 02:10:44 -0800
Subject: Human scum: Jim Bidzous of RSA
Message-ID: <52B56924.7030605@cypherpunks.to>

Always knew that 2 faced cocksucker had done an AG Crypto on all of his
customers,

http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220

thats why he had such a hard on to stop PGP

bet Sternlight was receiving black funds also...


        hope both these fuckers get cancer and die slowly, painfully and
horribly!!


-- 
Governments are instituted among men,
 deriving their just powers from the consent of the governed,
that whenever any form of government becomes destructive
of these ends, it is the right of the people to alter or
 abolish it, and to institute new government, laying its
 foundation on such principles, and organizing its powers
 in such form, as to them shall seem most likely to effect
 their safety and happiness.’




From gwen at cypherpunks.to  Sat Dec 21 02:18:45 2013
From: gwen at cypherpunks.to (gwen hastings)
Date: Sat, 21 Dec 2013 02:18:45 -0800
Subject: Human scum: Jim Bidzous of RSA
In-Reply-To: <52B56924.7030605@cypherpunks.to>
References: <52B56924.7030605@cypherpunks.to>
Message-ID: <52B56B05.50002@cypherpunks.to>

And I am of course referring to code and events and truth that far
predated the latest reuters article.. lots of white washing now however
especially in that article...

   fucking bidzous!


-- 
Governments are instituted among men,
 deriving their just powers from the consent of the governed,
that whenever any form of government becomes destructive
of these ends, it is the right of the people to alter or
 abolish it, and to institute new government, laying its
 foundation on such principles, and organizing its powers
 in such form, as to them shall seem most likely to effect
 their safety and happiness.’




From gwen at cypherpunks.to  Sat Dec 21 11:57:00 2013
From: gwen at cypherpunks.to (gwen hastings)
Date: Sat, 21 Dec 2013 11:57:00 -0800
Subject: Human scum in the crypto/security industry industry
Message-ID: <52B5F28C.9090306@cypherpunks.to>

lots of Human scum, snake oil peddlers etc in my industry,

back at Sunsoft in 1994 I used to have to work with
http://en.wikipedia.org/wiki/Gil_Shwed as he was writing the initial
versions of Firewall-1(was being done on Solaris 2.4 at the time).
He had a desk in Bldg 5 at Sunsoft also

Gil as Wikipedia states(http://en.wikipedia.org/wiki/Gil_Shwed) and as
Bamford writes was a member of the Mossad linked Unit 8200.  He was
extremely eager to get FW-1(which Sun had NO source to at that time)
into the hands of Sun Customers.. LOTS of SUN customers.

And given what I was doing at the time for the 5 Sun Companies, I was a
Sun Industrial Relations 'skunk' as in skunkworks there was a bit of
pressure for me to use Fw-1 at my offsite lab(s) and my home lab(NOT), I
already had alternatives.

Fortunately as I was also working with SunLabs we had internally
developed alternatives which we did control all sources for
ie Sunscreen-1, unfortunately there was an insistance we use BSAFE(which
I ALWAYS had a LOT of resistance to) for the SKIP crypto tunnels, as we
are coming to find out..  there were evil reasons for this. Skip had
some internal defenses against such skulduggery such as rapidly
switching out keys.. use of DH.. and both Ashar Aziz and Whit Diffie had
their hand in the design. But if there were flaws in the random number
gen that were not known to us then this puts a whole different light on
things like none of the defenses mean anything when keys were predictable.


     and I used to think John Young had finally skipped over the edge

John My apologies..



      Fucking SNAKE OIL salesmen

       gwen
ps its becoming VERY obvious to me that RSA Inc. and Jim Bidzos were
filthy from the start. I thought an AG-Crypto was being run on us but I
was told I was being overly paranoid and to take off my tin foil hat(NOT).

-- 
Governments are instituted among men,
 deriving their just powers from the consent of the governed,
that whenever any form of government becomes destructive
of these ends, it is the right of the people to alter or
 abolish it, and to institute new government, laying its
 foundation on such principles, and organizing its powers
 in such form, as to them shall seem most likely to effect
 their safety and happiness.’




From adam at cypherspace.org  Sat Dec 21 03:10:42 2013
From: adam at cypherspace.org (Adam Back)
Date: Sat, 21 Dec 2013 12:10:42 +0100
Subject: soft backdoors: ECDSA vs RSA vs EdDSA (aka EC Schnorr) (Re: BlueHat
 v13 crypto talks - request for leaks ;))
In-Reply-To: <E1Vsn8B-0003Cc-VG@login01.fos.auckland.ac.nz>
References: <CA+cU71mMhSKA+DJW5DBWyJvBbGk1LLJGCBjK4BPwgvGvRs-sog@mail.gmail.com>
 <E1Vsn8B-0003Cc-VG@login01.fos.auckland.ac.nz>
Message-ID: <20131221111042.GA19555@netbook.cypherspace.org>

Vaudenay's report writes up an attack developed by Daniel Bleichenbacher
which he presented to some standards groups but did not publish.  As a
result of that the DSA standard was modified.  As I recall with about
1million signatures he could recover the private key due to the small bias
from the formual Peter mentioned: k = G(t,KKEY) mod q ie if |n| = 256-bits
where n is the order of the group, then G(t,KKEY) is distributed with a
rectangular distribution in {0,2^256-1} and q is < 2^256-1.  As I read it
Bleichenbacker did not try that hard to optimize his attack, it was enough
to show the NIST/NSA designed DSA RNG was biased enough to break DSA in a
server / automated environment.

Maybe further optimizations would have been possible...  Maybe this DSA flaw
spotted by Bleichenbacker was another NSA soft-sabotage attempt (making
standards security brittle in the knowledge that it some people will fail to
harden it, and also it gives a plausibly deniable backdoor design for
colluding business entities, or double-agents on the payroll (former NSA
people say)).  In fact DSA was even designed by a former NSA cryptographer.
http://en.wikipedia.org/wiki/Digital_Signature_Algorithm (Dr David Kravitz,
a former NSA employee).

The approach I prefer is the deterministic DSA approach where k = MAC(d,M)
where d is the private DSA/ECDSA key and M is the message, plus bias
removal.  Bernsteins EdDSA (which despite the name is actually a Schnorr
signature over an Edwards curve) also uses the same technique.  This is
standardized in an RFC.  If people are going to use DSA/ECDSA they should
use this deterministic DSA.  Personally I prefer EC Schnorr because Schnorr
is just a better, simpler, more secure and more flexible signature (supports
simplel blinding, compact multi-sig, clearer security proofs, better
security margin, less dependence on hash properties etc).  To my mind DSA's
only reason for existence is historic due to patents.  It is inferior by all
metrics to Schnorr, just that Scnorr's patent didnt expire until
http://en.wikipedia.org/wiki/Schnorr_signature feb 2008.

Anyway as Bernstein has put forward EdDSA with parameters and multiple
security, speed, simple constant time, non-key related, nor message
execution time, and provably non-cooked curve parameters (and there perhaps
remains some needless ambiguity about the magic constants used to seed the
ECDSA parameters) there is no reason in my opinion not to use EdDSA aka EC
Schnorr in any new systems.

Of course RSA is good also, and simpler parameter definition, the main
downside being the large keys for same security margin (3072-bit).

Adam

On Tue, Dec 17, 2013 at 06:23:43PM +1300, Peter Gutmann wrote:
>Tom Ritter <tom at ritter.vg> writes:
>>On 14 December 2013 14:51, Peter Gutmann <pgut001 at cs.auckland.ac.nz> wrote:
>>
>>> For example if you
>>>  follow DSA's:
>>>
>>>   k = G(t,KKEY) mod q
>>>
>>> then you've leaked your x after a series of signatures, so you need to know
>>> that you generate a large-than-required value before reducing mod q.  The
>>> whole DLP family is just incredibly brittle, a problem that RSA doesn't
>>> have.
>>
>>This is different from the normal 'repeated/non-random k leads to private
>>key', is it not?  Is there a paper/reference I can read more about this
>>attack?
>
>Yes, this is one of several variations of subtle leak-the-private-key issues,
>rather than the standard obvious-leak-the-private-key.  The code comment I've
>got has, alongside other observations:
>
>           The best reference for this is
>           probably "The Insecurity of the Digital Signature Algorithm with
>           Partially Known Nonces" by Phong Nguyen and Igor Shparlinski or
>           more recently Serge Vaudenay's "Evaluation Report on DSA"
>
>Then there's tricks like:
>
>   Suppose that the
>   certificate contains a copy of the certificate signer's DSA parameters,
>   and the verifier of the certificate has a copy of the signer's public key
>   but not the signer's DSA parameters (which are shared with other keys).
>   If the verifier uses the DSA parameters from the certificate along with
>   the signer's public key to verify the signature on the certificate, then
>   an attacker can create bogus certificates by choosing a random u and
>   finding its inverse v modulo q (uv is congruent to 1 modulo q).  Then
>   take the certificate signer's public key g^x and compute g' = (g^x)^u.
>   Then g'^v = g^x.  Using the DSA parameters p, q, g', the signer's public
>   key corresponds to the private key v, which the attacker knows.  The
>   attacker can then create a bogus certificate, put parameters (p, q, g')
>   in it, and sign it with the DSA private key v to create an apparently
>   valid certificate.  This works with the DSA OID that makes p, q, and g
>   unauthenticated public parameters and y the public key, but not the one
>   that makes p, q, g, and y the public key
>
>That's not leaking the private key, but it allows signature forgery via
>another mechanism that's totally unrelated to "was the fundamental DSA
>algorithm implemented correctly".  As I said, the DLP algorithms are really,
>really brittle, you have to worry about all sorts of things that aren't a
>concern with RSA.
>
>Peter.




From adam at cypherspace.org  Sat Dec 21 03:13:58 2013
From: adam at cypherspace.org (Adam Back)
Date: Sat, 21 Dec 2013 12:13:58 +0100
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human scum: Jim
 Bidzous of RSA)
In-Reply-To: <52B56B05.50002@cypherpunks.to>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
Message-ID: <20131221111358.GB19555@netbook.cypherspace.org>

Its hard to prove unfortunately, unless more leaks come out.  Probably there
exists no documentation to prove or disprove it within RSA, as to whether
RSA knew about the backdoor at the time it signed the deal.  Maybe there
would be documents within NSA.

However what you could say is no one at RSA, or in general, reacted much
following Ferguson et al's pointing out the design issue of there being an
undetectable backdoor in the RNG.

Adam

ps I think its Bidzos.

On Sat, Dec 21, 2013 at 02:18:45AM -0800, gwen hastings wrote:
>And I am of course referring to code and events and truth that far
>predated the latest reuters article.. lots of white washing now however
>especially in that article...
>
>   fucking bidzous!
>
>
>-- 
>Governments are instituted among men,
> deriving their just powers from the consent of the governed,
>that whenever any form of government becomes destructive
>of these ends, it is the right of the people to alter or
> abolish it, and to institute new government, laying its
> foundation on such principles, and organizing its powers
> in such form, as to them shall seem most likely to effect
> their safety and happiness.’




From electromagnetize at gmail.com  Sat Dec 21 11:56:10 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 21 Dec 2013 13:56:10 -0600
Subject: PVDF and sensing - (07)
Message-ID: <CADhsnxfAT3zQyWJgwjqVNRDP7vxbOmVxpAJ=zMpXW0Wvfm-OcA@mail.gmail.com>

heading down the final stretch...

my fascination with sensors as an electronics concept
began with small pamphlet electronics instruction books
from Forrest Mims [0] found at Radio Shack though they
are widely available online these days. [1]  if interested
in programming microcontrollers though have not been
introduced via non-computer breadboard electronics, it
may be of interest to look at and learn from circuits in
these notebooks, which provide basic concepts for how
the circuits work and the principles they involve. for a
technical person it could be instructive, for those like
myself with a mental gap in the fundamentals there
may still be questions that need to be answered
before able to access and intuitively understand
exactly what is going on, modifying it from there

so, engineering mindset, great resource. artistic
mindset, perhaps still a significant boundary before
understanding though i have trouble with reading and
ambiguous concepts so it could be only my limitation
that kept me from learning the basics of electronics
in terms of circuitry. another is: having the parts that
are needed, versus just looking at the diagrams and
understanding what is happening, or using these for
reference, to build other circuits via same approach
or extending or borrowing certain parts of designs.

quite interesting to locate a Mims book on sensors
and piezo kit together in regard to ongoing issues
with piezo sensors and energy harvesting. [2]

what captured my imagination was the particular
notebook on sensors, their conceptual nature as
this relates to issues of feedback and intelligence
that effectively maps onto switches and gauges
as measurements of activity, indicators of events;
likewise, the reversibility of sensors, how some if
not many can be inverted in their functioning, such
that a microphone can be a speaker and vice versa

PVDF piezo film as a sensor material exemplifies
the tremendous range that a given material and its
properties can connect with, in varying dynamics
and dimensions. (if not mistaken, it can even detect
airflow while potentially creating air flow likewise)


and so one of these unique properties of piezo film
is that it can detect temperature differences. this
got me wondering (reading of its application in the
tech manual), that given its incredible sensitivity,
would it be able to detect electromagnetic fields
due to the gradiated change in radiation levels
surrounding wires, in proximity to EMF signals

this combined with the idea of the PVDF sensor
as an ANTENNA then had me wondering if this
could function in a similar realm as the standard
linear Hall effect sensor [3] that senses magnetic
fields and functions as a strain gage (analog) or
on/off switch (binary/digital) in the presence of
electromagnetic fields. and thus EMF meters,
most presumably, utilized Hall effect sensors
that have multiple axes, 1-axis to 3-axis that
relate to the geometry of the EM field in space,
and thus rotating a probe for an EMF meter in
a given context which generate varying signal,
helping define the shape and direction of the
signal, as it is positioned in space [4] [5]


so my thinking was as follows... there are these
small piezo sensor 'film tabs' that can be hooked
up to a speaker, and if they could detect signals
from home wiring in the wall, as a microphone,
then essentially it approximates an EMF meter
without the display details, though could indicate
an intensity level by how loud or soft the noise
that is picked up. perhaps this is actually not
possible though it my questioning of its use.

and this could require holding or moving the
piezo film tab, the rectangle with an audio
cable connected to it, then connected with a
small preamp/mixer, amplifier or headphones,
and perhaps moving it along the wall -- which
seems unlikely due to sensitivity -- because it
would generate massive noise seemingly, or,
to potentially move it in the air, likewise that
could seemingly make lots of noise by its
movement, masking any other signals.

it seems to go nowhere as an approach,
yet my question remains that if this PVDF
material can and does function as an antenna
and it could pick up signals via vibrations, that
perhaps if it was held or moved against a wall
with electrical wiring inside, it could access
this intense vibrational activity in some way

it is obviously unclear as an approach, as
multiple aspects coincide, both in attempting
to access a signal and how this could occur...
and thus: the issue could be having the PVDF
film tab register 'temperature variation' as a way
to monitor the difference in heat between a less
electromagnetic realm and more electromagnetic
realm as the radiation is monitored by the sensor

and is this possible or not. and further, would the
fact that the device is a capacitor then influence
its charge via induction, such that the EMFs
would charge the PVDF film, again via vibration
or heat, though which could be used as electricity
in a circuit it connects to, via energy harvesting.

the concept is that the EMF meter as device
would generate power when detecting signals.

and so the existing rectangular film tabs [6] are
potentially one way of going about this, in terms
of 'mapping temperature' as mapping of EMFs,
and seemingly related to this is the issue of the
sensor being shielded or not, as this potentially
relates to issues of tuning. what frequency or
temperature range can influence the sensor

a hypothetical application the PVDF sensor
used for mapping out EMFs, is that a cellphone
could contain such a device and be held against
the wall or on a shelf in which there is electrical
wiring, and the induction that occurs from the
wires to the capacitor via vibration of EMFs
could in effect provide charging power to the
cellphone or other once-battery-reliant device,
if energy harvesting was paired with wiring in
the home and electrical power already in place,
it would be an issue of locating it, excavating
a hidden environment, so the EMF meter as
indicator of signal strength or of radiation levels
as temperature could provide a diagnostic of a
local area via mapping it out as EM environment,
and then situate devices in this specific location,
in proximity to wires to maximize energy harvest
via vibration that perpetually charges the capacitor

(note here: if the PVDF film were etched as was
previously mentioned with further patterning, this
could massively increase voltage potentially, via
increasingly its capacitance or storage capacity
for holding energy, seemingly of higher voltage)


though what really got my mind spinning was
the idea of another format for this piezo polymer
and that is 'piezo coaxial cable'. [7] [8]

in that, this idea of PVDF as an antenna then is
tending towards a shape or form that has been
used for antennas, that is: a length of wire that
picks up signals as wavelengths geometrically
align with, map onto, influence its properties.

(that is, if not mistaken in how things work)


and so my mind starts thinking of making a
loop out of this cable, as if a transponder that
is used to track some emitting signal, or as a
certain type of TV console antenna even, if not
rabbit ears in retrospect. and what is the actual
difference in these different materials functioning,
plain metal and piezo polymer, in terms of antenna

the obvious is that the latter generates power if it
begins to vibrate. and holds onto it as a capacitor,
so it builds up and stores the external influence.

though more, consider the issue of high-voltage,
that a long length of wire could potentially hold a
lot of charge. and this in a context of sensing...


there is the classic example of 'wireless power'
in a person holding fluorescent tube lights under
the powerlines of a high-voltage pylon corridor
that in turn illuminates the lights via EMFs by
way of the surrounding intense levels of radiation
that bathe the area in proximity to such towers

so there is massive energy in the air, ionizing it,
around high voltage electric transmission towers,
enough to light a fluorescent (AC) lightbulb that
otherwise requires a ballast/transformer to do so
(again, if not mistaken), in that charge/electrons
are rapidly moving back and forth through a gas
held inside the unlit tube that then generates light
by triggering a reaction that releases or produces
photons via the current shooting through the gas

(sidenote: LEDs interesting in similar way, light
or photons produced by jumping gap in a circuit)

note: DANGER: DO NOT ATTEMPT TO DO THIS
WITHOUT PROPER EXPERTISE/QUALIFICATIONS...

now imagine you have a loop of piezo coaxial cable
that can function as an antenna. potentially and-or
seemingly, it would be able to 'read' the temperature
difference via the radiation in the area underneath or
nearby similar high-voltage towers. though this may
co-exist as a variable with frequency/vibration thus
heat may just be another way of saying the same
thing, though in a more tangible or perceivable way,
in that its influence may be more apparent.

here is why it is not advisable for a do-it-yourselfer-
because any length of this piezo cable is a capacitor
that can store energy, and the larger the cable the
more voltage that could be stored, it would appear,
and thus if such an antenna were use and capable
of storing large amounts of high voltage charge, it
then could be deadly dangerous to be holding onto
this cable because it would be inducing current from
the powerlines and potentially into the body, in terms
of its grounding (say, straight through an arm to heart
then out one foot or both) potentially like getting hit
by lightning. any precautions that would be taken
by electrical workers that work on high voltage lines
would be relevant as security precautions for any
such experimentation. and yet, if a circuit were
made around such an antenna -- potentially via
paired or matching VIBRATION alone, this same
piezo cable device could potentially provide much
more power and current via its energy harvesting.

(or so it is speculated here)

in a more removed situation, or a smaller antenna,
it could potentially be used to map EMFs via piezo
wire in the way Hall effect sensors are used today,
though again with the benefit of energy harvesting
and providing power to circuitry. thus piezo cable,
as antenna, could have its own unique attributes
and properties that could better align in certain
situations or circumstances to provide power or
function as an antenna, whereby the 'microphone'
or listening is occurring in a vibrational realm that
is not connected to material vibration beyond its
own support structure, instead, as antenna it is
tuning into strong fields (as heat, here proposed)
that would potentially be capable of providing this
source of vibrational needed to power circuitry,
yet further, also a signal of meaning about the
nature of the environment in its electromagnetic
composition and ordering, mapping or direction
based on these attributes, features of landscape
that is relevant in terms of health and energy


so then i was done with thinking about it and
then encountered a photograph that inspired
another layer of thinking within this domain...

it was of a woman's hat [9] created by a fashion
designer that spoke to these issues in terms of
its language and aesthetics, providing insight into
the nature of the questions involved.

what if, for instance, the piezo film tab sensors
were able to monitor the heat or radiation as this
correlates to vibrational frequencies of cellphones
as they are held against the skull, and evaluate
the radiation involved at the blood-brain barrier as
this influences tumor development in humans via
sending this transmission of cellphone signals
from the phone to the cellular towers? in other
words, what if this little sensor could be placed
on a hat, alongside the surface of the skin, and
register and monitor the radiation levels from
omnidirectional antennas shooting EMFs and
coded patterns into the human brain, as part of
this relation between people, tools, technology
and infrastructure - "daily ~communionication"

again, the wonders of the piezo film indicate that
they do respond to monitoring of skin, and thus
likely a viable approach to modeling this relation,
and testing against "official evidence" about how
these antennas and vibrations are influencing the
human physiology. real-time cellphone monitoring

(another approach could involve a PVDF sensor at
the only opening of an otherwise EMF-opaque box
or container that has a cellphone in it, attempting to
transmit or radiate its signal, and measuring activity
via vibration or heat from this at various distances)

additional hats provided further insight into aspects
of multiple tunings [10] via adjusting cantilevers or
tuning forks, to what frequencies are related to and
through, as part of consciousness as information,
this in a non-electromagnetic framework seemingly.
and also of the nature of the mind being targeted by
hostile signaling [11] in these toxic domains of the
technical wilderness, functioning against humanity.
in that disease and illness correlate with these same
issues as they remain ignored and unaddressed, and
allowing continuing abuse of power based on hidden
leverage that results from no checks and balances
upon unrestrained technological development for
private goals and agendas, against public interest


the kicker is that such technology could already be
deployed in a hidden framework or context, just as
it is hard to imagine ubiquitous mass surveillance via
technological infrastructure without this corresponding
in some significant way to a paid informant network on
the ground, in close proximity, allowing full spectrum
monitoring that tends towards gossip as power that
is exploited in the political bias within infrastructure,
emperor no clothes policy laid bare via own tattle tales

thus, what if likewise, the potential for such sensing as
harvesting of free energy already exists yet remains in
a realm of secrecy, leveraged against populations on
the outside of this inner society. what if different truths
exist that remain unaccounted for, different economics
that then become the basis for exploitation via illusion,
via not sharing the discoveries and using this for power,
to take over domains via ruse, deception, ill-intent, etc


in other words: the conspiracy revealed, now out in the open...

take for instance the unusual aesthetics of a local substation
for electric power 'delivery', like a router, bus, or hub that then
transforms the voltage en route to its destination. under the
ordinary or standard model of power distribution, this could
be assumed to function in one way and one way only...


powerplant ==> transmission towers ==> substation ==> distribution poles


that is, the power is generated at a power station, moved
through high-voltage cables suspended from towers to a
substation, where this power is stepped down and then
further distributed via wooden poles to various dwellings

though 'the antennas' could be for lightning protection, it
seems highly unusual to have a large array of them or at
least this design approach has not yet been encountered
before this, and calls into question what is new about it.

i had previously speculated it was a free energy substation
tapping into atmospheric electricity via the antennas, though
until the PVDF sensors did not understand how this might be
possible. in fact, thinking about it right now, combining piezo
antennas with HAARP atmospheric injections of frequency is
potentially the model for remote power delivery at national or
international scale, ala Nikola Telsa's Wardenclyffe Tower [13]

in this scenario, the substation would be the 'generator' in that
it could tune into a given vibration (perhaps Schumann resonance)
and create high voltage electricity on-site, via remote transfer of
energy -as information- seemingly, outside an electromagnetic
context yet tied back into it via properties of nature, its order.
in this way, power delivery could begin at the substation locally,
then distribute back outwards to both high-voltage lines and the
reduced-voltage distribution poles, from the substation itself, a
decentralized power generation and delivery system, in effect,
locally, though harmonized at a larger scale via atmospheric
electricity as the generator or transmitter of 'motive power',
if not conceptualizing this in error. that would be the illusion,
that the powerplant is sending the power and not substation


 substation ==> transmission/distribution ==> local power


thus like a crystal oscillator functioning in reverse as piezo sensor,
if 'free energy' were being harvested at the substation-level, then a
different organization of these relations exists than what is said to
exist and used as a basis for top-down power structures in society.
a decentralized, distributed, non-toxic energy that is limitless versus
an infrastructure based on oil and gasoline and goal and nuclear energy
that is destructive, basically raping the earth and likewise its inhabitants
to fuel a given insane development strategy functioning against humanity
as this aligns with 'green politics' and 'environmentalism', its politics and
moral agenda within what is a warped accounting for various such factors.

in other words, perhaps battery power is only an issue for those on
the outside of this. if it indeed were to exist as a parallel infrastructure
in the everyday environment. and maybe that is being used as leverage,
a secret hidden development with different economics, social dynamics,
and political goals that are not 'represented' in existing language, instead
functioning outside or beyond its limiting frameworks and outdated views
and beliefs, which provide cover and camouflage for sustaining trickery,
exploiting it, and securing its place in relation to the rogue world state,
thoroughly invested in its mission to serve its hidden special interests,
having divested humanity long ago for private rewards in doing so.

wouldn't it be nice to see a circuit diagram of how those antennas
are hooked up at the substation. really interesting if it involved more
than 'ground' and instead was part of a piezo-based energy harvesting
engine capable of generating constant high-voltage power, for instance.
and who would the power to such oversight to occur within society?
seemingly nobody. that is the entirety of the situation right there-

*game over*

(...as if anything was ever was that simple)


0. Forrest Mims
http://en.wikipedia.org/wiki/Forrest_Mims

1. Engineer's Mini Notebooks
http://www.forrestmims.com/engineers_mini_notebook.html

ex. books available from online vendor
http://www.jameco.com/1/1/47775-forrest-mims-books-forrest-mims-books-getting-started-electronics-pn-2112786.html

2. Vibration Sensor Kit and Forrest Mims book
http://www.jameco.com/1/1/47780-vibration-sensor-book-vibration-sensor-kit-forrest-mims-book.html

3. Hall effect sensor
http://en.wikipedia.org/wiki/Hall_effect_sensor

4. EMF measurement
http://en.wikipedia.org/wiki/EMF_measurement

5. example of EMF meters
http://www.lessemf.com/gauss.html

6. Piezo Film Elements
http://www.meas-spec.com/piezo-film-sensors/piezo-film-elements.aspx

7. Piezo Cable
http://www.meas-spec.com/piezo-film-sensors/piezo-cable.aspx

8. Measurement Specialties PVDF technical manual, p.26
http://contactmicrophones.com/techman.pdf

9. Supernova
http://www.pinterest.com/pin/178525572702799181/

10. http://www.pinterest.com/pin/178525572702801213/

11. http://www.pinterest.com/pin/178525572702801214/

12. unusual antenna array at local electric power substation
https://www.dropbox.com/s/0fckzaozs0tgs7r/substation_antennas.PNG

13. Wardenclyffe Tower
http://en.wikipedia.org/wiki/Wardenclyffe_Tower


gravitation, paraffin, Lamarckism




From electromagnetize at gmail.com  Sat Dec 21 12:21:38 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sat, 21 Dec 2013 14:21:38 -0600
Subject: footnote (07)
Message-ID: <CADhsnxfQLMU_VNteZN_FtMVRf-pmALebMj3LvnVu3VhS0Wh=-g@mail.gmail.com>

 i did not connect the two themes together until now,
 though consider again the residential high rise building
 with an antenna array on top, previously sent to the list,
 in the context that it could be harvesting its own power
 and disconnected from the surrounding energy grid via
 the antenna array at its crown. off the books energy, at
 the same time brutal wars fought to sustain oil power...

https://www.dropbox.com/s/yxxogxr190chkoc/array1.PNG
https://www.dropbox.com/s/1rpi0p7l1ne8qzq/array1b.PNG

 (how is that for ethics and morality of secret leadership,
 and issues of corruption, deception, hidden evil agenda)

 in other words: the antennas are for capturing energy and
 not just for communications signals, a la piezo technology

 again, how to audit the circuitry involved. who has authority
 to evaluate such systems in their technological functioning.

 0290.20   9202.51   0029.98




From coderman at gmail.com  Sat Dec 21 17:05:34 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 17:05:34 -0800
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human scum:
 Jim Bidzous of RSA)
In-Reply-To: <20131221111358.GB19555@netbook.cypherspace.org>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
 <20131221111358.GB19555@netbook.cypherspace.org>
Message-ID: <CAJVRA1Q04Qdy_HzNdc831d9Fn0VRKaqmQkoEubJTZYA5TZWW4Q@mail.gmail.com>

On Sat, Dec 21, 2013 at 3:13 AM, Adam Back <adam at cypherspace.org> wrote:
> Its hard to prove unfortunately, unless more leaks come out...  Maybe there
> would be documents within NSA.


the leaks have sharpened my appetite for names and numbers.

collaborators in mass product perversion need to be named;
the extent of filthy lucre lures employed delineated; today!




From coderman at gmail.com  Sat Dec 21 17:19:09 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 17:19:09 -0800
Subject: public notice: TLA scrutiny an opportunity for catching capabilities
Message-ID: <CAJVRA1RkAVAbbtt3zcoKajMW420tB7Ri_=6sFwtEsr=J9vHJfA@mail.gmail.com>

if you're under scrutiny[0] no better time to test than today :)

- collect sequences, collect imagery, collect signals, collect
collaborators, collect everything! (you'll find data later you didn't
recognize as relevant)
- honey tokens to trigger channel targets, see which takes.
- selective channels of dis-information to quantify compromise.
- observe counter-reaction, counter counter-counter-measures,
- continually iterate process until truce or truncheon-ed...

caution: this can lead to escalation!



0. "Snowden ally Appelbaum claims his Berlin apartment was invaded"
  http://www.dw.de/snowden-ally-appelbaum-claims-his-berlin-apartment-was-invaded/a-17315069

"""
Berlin resident and US national Jacob Appelbaum told Saturday's
edition of the "Berliner Zeitung" daily that he believed he was under
surveillance in the German capital. Appelbaum told the paper that
somebody had broken into his apartment and used his computer in his
absence.

"When I flew away for an appointment, I installed four alarm systems
in my apartment," Appelbaum told the paper after discussing other
situations which he said made him feel uneasy. "When I returned, three
of them had been turned off. The fourth, however, had registered that
somebody was in my flat - although I'm the only one with a key. And
some of my effects, whose positions I carefully note, were indeed
askew. My computers had been turned on and off."
"""




From coderman at gmail.com  Sat Dec 21 17:32:43 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 17:32:43 -0800
Subject: public notice: TLA scrutiny an opportunity for catching
 capabilities
In-Reply-To: <CAJVRA1RkAVAbbtt3zcoKajMW420tB7Ri_=6sFwtEsr=J9vHJfA@mail.gmail.com>
References: <CAJVRA1RkAVAbbtt3zcoKajMW420tB7Ri_=6sFwtEsr=J9vHJfA@mail.gmail.com>
Message-ID: <CAJVRA1R8ARre_8mVR0Huxr-xLsoz_9v3_Bhtt3xKRZod0+Gncw@mail.gmail.com>

On Sat, Dec 21, 2013 at 5:19 PM, coderman <coderman at gmail.com> wrote:
> if you're under scrutiny[0] no better time to test than today :)

this assumes they're trying to be sneaky and surreptitious, of course.

sometimes an entry is about show of force rather than collection.  US
residence some years ago forcibly entered, surveillance system HERF'd,
dog placed in backyard, entire domicile imaged with all drawers,
cabinets, closets, cupboards, everything opened (and more :) in space
of 15 minute trip to store and back.

in any case, this is only effective if you're actually intimidated.
best to make it yet another egregious waste of public funding instead!

;P




From coderman at gmail.com  Sat Dec 21 17:41:04 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 17:41:04 -0800
Subject: for those going to 30C3: Fwd: USB Sticks for TAILS [and OpenPGPv2
 smartcards, and Yubikeys, and ...]
Message-ID: <CAJVRA1Tuewt+MovxuuYUsFdoJ9SqdkqKP43KDFHXKk1kUHn7rg@mail.gmail.com>

---------- Forwarded message ----------
From: Moritz Bartl <moritz at torservers.net>
Date: Sat, Dec 21, 2013 at 6:35 AM
Subject: Re: [tor-talk] USB Sticks for TAILS


On 11/15/2013 01:50 PM, Moritz Bartl wrote:
> I am still undecided whether I want the final sticks to have a logo, or
> simply be blank to not attract too much attention. If you have a nice
> idea for a logo, let me know. I want to order 100 sticks in time for
> Chaos Communication Congress 30C3.

The sticks [1] have arrived, you will be able to buy them for roughly
$15 at Chaos Communication Congress. Maybe I can drop off some of them
at the table of Wau Holland Foundation or elsewhere. Best you come find
me, for example at the Tor Relay meetup [2].

I ended up buying *200* sticks, 100 of each type and color. I will post
a detailed bill and pictures next year.

I will also bring OpenPGPv2 smartcards [3] and Gemalto USB tokens [4]
that you can buy from me, and some Yubikeys. [5]

[1] https://blog.torservers.net/20131115/usb-sticks-for-tails.html
[2] https://events.ccc.de/congress/2013/wiki/Session:Torservers_Meetup
[3] http://shop.kernelconcepts.de/product_info.php?products_id=42
[4] http://www.cryptoshop.com/gemalto-idbridge-k30-usb-shell-token-v2.html
[5] https://www.yubico.com/

--
Moritz Bartl
https://www.torservers.net/




From sgreeran at gmail.com  Sat Dec 21 19:27:30 2013
From: sgreeran at gmail.com (Steven Greeran)
Date: Sat, 21 Dec 2013 19:27:30 -0800
Subject: FYI
Message-ID: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>

http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf

----------------------------------------------------------
IMPORTANT WARNING: This email (and any attachments) is only intended for
the use of the person or entity to which it is addressed, and may contain
information that is privileged and confidential. You, the recipient, are
obligated to maintain it in a safe, secure and confidential manner.
Unauthorized redisclosure or failure to maintain confidentiality may
subject you to federal and state penalties. If you are not the intended
recipient, please immediately notify us by return email, and delete this
message from your computer.
----------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 902 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131221/cd238a55/attachment.txt>

From coderman at gmail.com  Sat Dec 21 19:43:06 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 19:43:06 -0800
Subject: FYI
In-Reply-To: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
Message-ID: <CAJVRA1Txd0C8=xniYumj9vcFHLsmp-TqaguRAqscwGnjOkRVgA@mail.gmail.com>

On Sat, Dec 21, 2013 at 7:27 PM, Steven Greeran <sgreeran at gmail.com> wrote:
> http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf
>...

these people really hate Tor; they spelled it "the TOR Project"... on purpose.
  dicks!


on a related note, interpreting this document is an excellent exercise
in focusing on what is _not_ said, both in terms of qualifiers and
entire subjects/categories of omission.


oh that one might maintain a retrospective mapping from ongoing
Snowden leaks to misdirected / omitted / understated assertions and
recommendations in this Grade A Toothless Attention Distractor (aka,
"Report and Recommendations of The President’s Review Group on
Intelligence and Communications Technologies")




From shelley at misanthropia.info  Sat Dec 21 19:45:08 2013
From: shelley at misanthropia.info (shelley at misanthropia.info)
Date: Sat, 21 Dec 2013 19:45:08 -0800
Subject: FYI
In-Reply-To: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
Message-ID: <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>

&nbsp;On Dec 21, 2013 7:37 PM, Steven Greeran &lt;sgreeran at gmail.com&gt; wrote: 

http://www.whitehouse.gov/sites/default/files/docs/2013-12-12_rg_final_report.pdf

----------------------------------------------------------

Mind giving a brief description of what it is next time? &nbsp;I don't make a habit of downloading pdfs blindly from .gov sites (especially that one)

If it's the NSA review group report, it can also be found at Cryptome:
&nbsp;http://cryptome.org/2013/12/obama-nsa-report.pdf&nbsp;




-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 981 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131221/61350f0b/attachment.txt>

From coderman at gmail.com  Sat Dec 21 20:00:38 2013
From: coderman at gmail.com (coderman)
Date: Sat, 21 Dec 2013 20:00:38 -0800
Subject: FYI
In-Reply-To: <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
 <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
Message-ID: <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>

On Sat, Dec 21, 2013 at 7:45 PM,  <shelley at misanthropia.info> wrote:
> ...
> http://www.whitehouse.gov/sites/default/files/docs/quantuminsert-malware-loader.pdf
>
> ----------------------------------------------------------
>
> Mind giving a brief description of what it is next time?  I don't make a
> habit of downloading pdfs blindly from .gov sites (especially that one)

you say this like it's different from anything else you might request *grin*


> If it's the NSA review group report, it can also be found at Cryptome:
>  http://cryptome.org/2013/12/obama-nsa-report.pdf

indeed.  though this does bring up another question:
 i wonder if JYA will ever give in and support httpS?
... it would at least avoid trivial plaintext observation.



last but not least:
opsec tip#3164107562: you should assume everything remote and
retrieved is malicious.  grab in a throw away Qubes browser. convert
in a throw away parse and translate VM, then finally read and/or save
to a limited view VM using an open, trusted format.




From shelley at misanthropia.info  Sat Dec 21 20:11:33 2013
From: shelley at misanthropia.info (shelley at misanthropia.info)
Date: Sat, 21 Dec 2013 20:11:33 -0800
Subject: FYI
In-Reply-To: <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>
Message-ID: <20131222041135.939F1C00E84@frontend1.nyi.mail.srv.osa>

&nbsp;
On Dec 21, 2013 8:00 PM, coderman &lt;coderman at gmail.com&gt; wrote: 

&gt;&nbsp;http://www.whitehouse.gov/sites/default/files/docs/quantuminsert-malware-loader.pdf&nbsp;
&gt;


Okay, I laughed. &nbsp;Ya bastid ;)

&nbsp;&gt;&gt;indeed. though this does bring up another question: 
i wonder if JYA will ever give in and support httpS? 
... it would at least avoid trivial plaintext observation.&nbsp;

Good point...





-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 876 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131221/16085a00/attachment.txt>

From jya at pipeline.com  Sun Dec 22 05:32:58 2013
From: jya at pipeline.com (John Young)
Date: Sun, 22 Dec 2013 08:32:58 -0500
Subject: FYI
In-Reply-To: <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.g
 mail.com>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
 <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
 <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>
Message-ID: <E1Vuj8C-0001CJ-2B@elasmtp-junco.atl.sa.earthlink.net>


>indeed.  though this does bring up another question:
>  i wonder if JYA will ever give in and support httpS?
>... it would at least avoid trivial plaintext observation.

We did in October 2012 for acessing a few files:

https://secure.cryptome.us

Looks like a joke, right?

Rigging the whole site for https would require labor
beyond our diddly life-support system. And cheat the
visitors with sleight of clickery.

But there's more to this than sloth. Cryptome does
not offer security on the premise -- learned here, there
and everywhere HTTPS Everywhere promises -- that
Internet, telecom, whole wide world users need to
learn, be forced to learn, to provide their own security
and to never ever trust those who promise it for them.

Sysadmins and website operators spy viciously, all of them,
and it is a villainous -- business-like -- to offer security in the
same way spies do, as lure, trick and trap. Whenever a
sec system is invented that does not require sysadmins,
bosses and investors, with reliance upon government
funding for success, then it may be possible to rely upon
it for a single test, then abandon.

Comsec is a racket, remember rule 0. RSA and NSA are
merely the latest to be pilloried to hide the pillorers' complicity.

As discussed repeatedly, here, and at the winetasting blood
of christ, this treachery was known long ago, hey, Jude, bitch
about it for a while, then get on with doing it with new wine in
old bottles means and methods.

Which does raise the question: what the fuck is Cryptome up
to? Confession, har, hold a congressional hearing for that,
then read a slicker expose about the slick expose.

First, confessions are lies told to confessors who share
the gossip with cohorts to rig fancier recording booths.

Second, truth telling is as deceptive as comsec, salvation and
honesty.

Third, all security is corrupt like comms systems and
cipher systems -- deception is a synonym for security,
security a synonym for thievery by confidence gaming,
confidence a synonym for terrifying the populace in order
to sell faulty protection -- perfect protection kills the
market.

Finally, it should be be obvious, at least here, that HTTPS
is horse puckey. Any widely used means of security -- comsec
to natsec, anonymizers to Tor -- is compromised at birth and
by lifetime economic life-support systems, that is why it is
widely promoted, used and abused -- and very profitable.

"Electronic freedom," now that is ingenious cover-up of
absolutely no way to protect against EM compromise.
Like juxtaposing, embedding, Liberty with Security.










From pgut001 at cs.auckland.ac.nz  Sat Dec 21 12:58:49 2013
From: pgut001 at cs.auckland.ac.nz (Peter Gutmann)
Date: Sun, 22 Dec 2013 09:58:49 +1300
Subject: soft backdoors: ECDSA vs RSA vs EdDSA (aka EC Schnorr) (Re:
 BlueHat v13 crypto talks - request for leaks ; ))
In-Reply-To: <20131221111042.GA19555@netbook.cypherspace.org>
Message-ID: <E1VuTdJ-0006cH-1s@login01.fos.auckland.ac.nz>

Adam Back <adam at cypherspace.org> writes:

>Maybe this DSA flaw spotted by Bleichenbacker was another NSA soft-sabotage
>attempt (making standards security brittle in the knowledge that it some
>people will fail to harden it,

It wasn't "some people", it was almost every implementation at the time.  When
the standard very clearly says "do, X, Y, Z" then everyone sits down and
implements X, Y, and Z exactly as written (well, except for professional
paranoids who build in extra safety margins :-).  So if it was deliberately
weakened then it was a very successful weakening.

Peter.




From electromagnetize at gmail.com  Sun Dec 22 09:39:04 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 22 Dec 2013 11:39:04 -0600
Subject: FYI
In-Reply-To: <E1Vuj8C-0001CJ-2B@elasmtp-junco.atl.sa.earthlink.net>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
 <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
 <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>
 <E1Vuj8C-0001CJ-2B@elasmtp-junco.atl.sa.earthlink.net>
Message-ID: <CADhsnxfKGJ5w2wOu_-0GpPiWMnTKHcQDten55_76UhVDD0R+iQ@mail.gmail.com>

i was accessing this site for months, based on
frontpage cryptome recommendation. is it spoofed?

https://secure.netsolhost.com/cryptome.org/index.html




From jya at pipeline.com  Sun Dec 22 10:11:13 2013
From: jya at pipeline.com (John Young)
Date: Sun, 22 Dec 2013 13:11:13 -0500
Subject: FYI
In-Reply-To: <CADhsnxfKGJ5w2wOu_-0GpPiWMnTKHcQDten55_76UhVDD0R+iQ@mail.g
 mail.com>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
 <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
 <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>
 <E1Vuj8C-0001CJ-2B@elasmtp-junco.atl.sa.earthlink.net>
 <CADhsnxfKGJ5w2wOu_-0GpPiWMnTKHcQDten55_76UhVDD0R+iQ@mail.gmail.com>
Message-ID: <E1VunTS-0002q0-IH@elasmtp-junco.atl.sa.earthlink.net>


At 12:39 PM 12/22/2013, you wrote:
>i was accessing this site for months, based on
>frontpage cryptome recommendation. is it spoofed?
>
>https://secure.netsolhost.com/cryptome.org/index.html


No, it's legit. We don't promote it to avoid entrapping
believers in https. Go there are your peril same as the
quicksand quagmire.

Just to confess, we don't have control of our ISP servers,
thus warn of what is happening behind impossible security
promises from us to others. Warning seldom heeded so
powerful is the PR for online protection fantasies.

Few people have control of what their sites are used for.
Thus the cosmetic policy privacies which conceal
abuse bruises. Not as bad as 24x7x365 top security staff
outfoxed by Snowdens, similars and betters not doing
what Ed did, or is said to do, or misunderstood to do,
or is doing now under the noses of the explainers,
investigators, spoofers, black marketers, the usual
stabbers, slashees, hackes, punks, investors and angels.

This is not limited to Windows, applies to all software
and hardware and networks and whatchagot there
air-gapped, padlocked, SCIFed, totally secure, as
the Snowden hoarders brag, believing wierdly that
what Snowden did will never happen to them, or has
already happened, or happened on 0-day.








From tom at ritter.vg  Sun Dec 22 10:14:36 2013
From: tom at ritter.vg (Tom Ritter)
Date: Sun, 22 Dec 2013 13:14:36 -0500
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human scum:
 Jim Bidzous of RSA)
In-Reply-To: <20131221111358.GB19555@netbook.cypherspace.org>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
 <20131221111358.GB19555@netbook.cypherspace.org>
Message-ID: <CA+cU71mGm253wNgRvA7UKn205=eC_6Z0ORLKJUw+2ex5WvVDrw@mail.gmail.com>

On 21 December 2013 06:13, Adam Back <adam at cypherspace.org> wrote:
> ps I think its Bidzos.


I'm confused, but maybe missing something?  The article says:

'''
The stakes rose when more technology companies adopted RSA's methods
and Internet use began to soar. The Clinton administration embraced
the Clipper Chip, envisioned as a mandatory component in phones and
computers to enable officials to overcome encryption with a warrant.

RSA led a fierce public campaign against the effort, distributing
posters with a foundering sailing ship and the words "Sink Clipper!"

A key argument against the chip was that overseas buyers would shun
U.S. technology products if they were ready-made for spying. Some
companies say that is just what has happened in the wake of the
Snowden disclosures.

The White House abandoned the Clipper Chip and instead relied on
export controls to prevent the best cryptography from crossing U.S.
borders. RSA once again rallied the industry, and it set up an
Australian division that could ship what it wanted.

"We became the tip of the spear, so to speak, in this fight against
government efforts," Bidzos recalled in an oral history.
'''

'''
RSA, meanwhile, was changing. Bidzos stepped down as CEO in 1999 to
concentrate on VeriSign, a security certificate company that had been
spun out of RSA. The elite lab Bidzos had founded in Silicon Valley
moved east to Massachusetts, and many top engineers left the company,
several former employees said.
'''

It seems like Bidzous was out of RSA long before DUAL EC PRNG was even
proposed, and was in fact campaigning and strategizing against RSA
while he was there.  Where are references to other accusations or
behavior?

-tom




From coderman at gmail.com  Sun Dec 22 13:38:57 2013
From: coderman at gmail.com (coderman)
Date: Sun, 22 Dec 2013 13:38:57 -0800
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human scum:
 Jim Bidzous of RSA)
In-Reply-To: <E1VuoPh-0006Fj-37@elasmtp-spurfowl.atl.sa.earthlink.net>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
 <20131221111358.GB19555@netbook.cypherspace.org>
 <CA+cU71mGm253wNgRvA7UKn205=eC_6Z0ORLKJUw+2ex5WvVDrw@mail.gmail.com>
 <20131222184330.GA1519@netbook.cypherspace.org>
 <E1VuoPh-0006Fj-37@elasmtp-spurfowl.atl.sa.earthlink.net>
Message-ID: <CAJVRA1R5FUzdR8H7AgeGG0Nrho1TDCKdswL+PY+=QdGFMMesrw@mail.gmail.com>

On Sun, Dec 22, 2013 at 11:11 AM, John Young <jya at pipeline.com> wrote:
> Interesting ovelapping dates for Bidzos' participation in RSA and Verisign.
> Does the alleged tampering with RSA extend to Verisign? We use a
> Verisign token. Is that suspect?

another reason to love certificate transparency, convergence, pinning, etc...
  (yes John, httpS may be pwned, but it still flips pcap parser the bird! ;)




From coderman at gmail.com  Sun Dec 22 13:50:59 2013
From: coderman at gmail.com (coderman)
Date: Sun, 22 Dec 2013 13:50:59 -0800
Subject: ECDHE-RSA-CHACHA20-POLY1305-SHA256 server side support in OpenSSL /
 Nginx
Message-ID: <CAJVRA1S2KVQ-W05_i-HEAQOSMXEvmf+7pYxwBQtH6Dt8P5=5Ng@mail.gmail.com>

poked around some patches for chacha20 and poly1305 suites in
OpenSSL... there's more work to be done it seems.

is there a working setup for Linux server side chacha20 poly1305
suites with OpenSSL?  (i am probably not looking in the right place;
e.g. aead_support.patch, aead_ssl_support.patch,
chacha20poly1305.patch,)

best regards,




From jya at pipeline.com  Sun Dec 22 11:11:24 2013
From: jya at pipeline.com (John Young)
Date: Sun, 22 Dec 2013 14:11:24 -0500
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human
 scum: Jim Bidzous of RSA)
In-Reply-To: <20131222184330.GA1519@netbook.cypherspace.org>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
 <20131221111358.GB19555@netbook.cypherspace.org>
 <CA+cU71mGm253wNgRvA7UKn205=eC_6Z0ORLKJUw+2ex5WvVDrw@mail.gmail.com>
 <20131222184330.GA1519@netbook.cypherspace.org>
Message-ID: <E1VuoPh-0006Fj-37@elasmtp-spurfowl.atl.sa.earthlink.net>

Interesting ovelapping dates for Bidzos' participation in RSA and Verisign.
Does the alleged tampering with RSA extend to Verisign? We use a
Verisign token. Is that suspect?

http://www.verisigninc.com/en_US/news-events/press-room/executive-bios/james-bidzos/index.xhtml

James Bidzos is president and chief executive officer of Verisign. He 
also serves as chairman of the board of directors and has been 
executive chairman since August 2009.

As the founder of Verisign, Bidzos is an Internet and security 
industry pioneer whose accomplishments include building RSA Security 
into the early standard-bearer for authentication and encryption, and 
launching Verisign as a company in 1995 to develop the digital 
certificate infrastructure for Internet commerce.

Before returning to the president and chief executive role in August 
2011, Bidzos served as Verisign's first president and CEO and also 
served as Verisign's chairman of the board of directors from April 
1995 until December 2001, as vice chairman from December 2001 to July 
2007, and as interim CEO from July 2008 to August 2009. Bidzos served 
as president and CEO of RSA Security from 1986 to February 1999, and 
then served as RSA's vice chairman from 1999 to May 2002.

Recently, Bidzos was inducted into The National Cyber Security Hall 
of Fame. He is also one of Time Magazine's "Digital 50" and is in 
CRN's Computer Industry Hall of Fame.





From jamesdbell8 at yahoo.com  Sun Dec 22 16:03:57 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Sun, 22 Dec 2013 16:03:57 -0800 (PST)
Subject: Exclusive: Secret contract tied NSA and security industry pioneer
Message-ID: <1387757037.30263.YahooMailNeo@web141206.mail.bf1.yahoo.com>



http://news.yahoo.com/exclusive-secret-contract-tied-nsa-security-industry-pioneer-001729620--finance.html


By Joseph Menn 
SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software 
that it could crack into widely used computer products, the U.S. 
National Security Agency arranged a secret $10 million contract with 
RSA, one of the most influential firms in the computer security 
industry, Reuters has learned.
Documents leaked by former NSA contractor Edward Snowden show that the 
NSA created and promulgated a flawed formula for generating random 
numbers to create a "back door" in encryption products, the New York 
Times reported in September. Reuters later reported that RSA became the 
most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal 
computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that 
set the NSA formula as the preferred, or default, method for number 
generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more 
than a third of the revenue that the relevant division at RSA had taken 
in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had 
shocked some in the close-knit world of computer security experts. The 
company had a long history of championing privacy and security, and it 
played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and 
communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged 
customers to stop using the NSA formula after the Snowden disclosures 
revealed its weakness.
RSA 
and EMC declined to answer questions for this story, but RSA said in a 
statement: "RSA always acts in the best interest of its customers and 
under no circumstances does RSA design or enable any back doors in our 
products. Decisions about the features and functionality of RSA products are our own."
The NSA declined to comment.
The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic 
erosion of security tools. NSA documents released in recent months 
called for using "commercial relationships" to advance that goal, but 
did not name any security companies as collaborators.
The NSA came under attack this week in a landmark report from a White 
House panel appointed to review U.S. surveillance policy. The panel 
noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it.
Most of the dozen current and former RSA employees interviewed said 
that the company erred in agreeing to such a contract, and many cited 
RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred.
But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.
"They did not show their true hand," one person briefed on the deal 
said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.
STORIED HISTORY
 View gallery    
A National Security Agency (NSA) data gathering facility is seen in Bluffdale, about 25 miles (40 km …
Started by MIT professors in the 1970s and led for years by ex-Marine Jim Bidzos, RSA and its 
core algorithm were both named for the last initials of the three 
founders, who revolutionized cryptography. Little known to the public, 
RSA's encryption tools have been licensed by most large technology 
companies, which in turn use them to protect computers used by hundreds 
of millions of people.
At 
the core of RSA's products was a technology known as public key 
cryptography. Instead of using the same key for encoding and then 
decoding a message, there are two keys related to each other 
mathematically. The first, publicly available key is used to encode a 
message for someone, who then uses a second, private key to reveal it.
From RSA's earliest days, the U.S. intelligence establishment worried 
it would not be able to crack well-engineered public key cryptography. 
Martin Hellman, a former Stanford researcher who led the team that first invented the technique, said NSA experts tried to talk him and others 
into believing that the keys did not have to be as large as they 
planned.
The stakes rose 
when more technology companies adopted RSA's methods and Internet use 
began to soar. The Clinton administration embraced the Clipper Chip, 
envisioned as a mandatory component in phones and computers to enable 
officials to overcome encryption with a warrant.
RSA led a fierce public campaign against the effort, distributing 
posters with a foundering sailing ship and the words "Sink Clipper!"
A key argument against the chip was that overseas buyers would shun 
U.S. technology products if they were ready-made for spying. Some 
companies say that is just what has happened in the wake of the Snowden 
disclosures.
The White House abandoned the Clipper Chip and instead relied on export controls to 
prevent the best cryptography from crossing U.S. borders. RSA once again rallied the industry, and it set up an Australian division that could 
ship what it wanted.
"We became the tip of the spear, so to speak, in this fight against government efforts," Bidzos recalled in an oral history.
RSA EVOLVES
RSA and others claimed victory when export restrictions relaxed.
But the NSA was determined to read what it wanted, and the quest gained urgency after the September 11, 2001 attacks.
RSA, meanwhile, was changing. Bidzos stepped down as CEO in 1999 to 
concentrate on VeriSign, a security certificate company that had been 
spun out of RSA. The elite lab Bidzos had founded in Silicon Valley 
moved east to Massachusetts, and many top engineers left the company, 
several former employees said.
And the BSafe toolkit was becoming a much smaller part of the company. By 2005, BSafe and other tools for 
developers brought in just $27.5 million of RSA's revenue, less than 9% 
of the $310 million total.
"When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, who rose to 
lead engineering and the Australian operation before he left in 2005. 
"It became a very different company later on."
By the first half 
of 2006, RSA was among the many technology companies seeing the U.S. 
government as a partner against overseas hackers.
New RSA Chief Executive Art Coviello and his team still wanted to be 
seen as part of the technological vanguard, former employees say, and 
the NSA had just the right pitch. Coviello declined an interview 
request.
An algorithm called Dual Elliptic Curve, developed inside the agency, was on the road to 
approval by the National Institutes of Standards and Technology as one 
of four acceptable methods for generating random numbers. NIST's 
blessing is required for many products sold to the government and often 
sets a broader de facto standard.
RSA adopted the algorithm even before NIST approved it. The NSA then 
cited the early use of Dual Elliptic Curve inside the government to 
argue successfully for NIST approval, according to an official familiar 
with the proceedings.
RSA's 
contract made Dual Elliptic Curve the default option for producing 
random numbers in the RSA toolkit. No alarms were raised, former 
employees said, because the deal was handled by business leaders rather 
than pure technologists.
"The labs group had played a very intricate role at BSafe, and they were basically gone," said labs veteran Michael Wenocur, who left in 1999.
Within a year, major questions were raised about Dual Elliptic Curve. 
Cryptography authority Bruce Schneier wrote that the weaknesses in the 
formula "can only be described as a back door."
After reports of the back door in September, RSA urged its customers to stop using the Dual Elliptic Curve number generator.
But unlike the Clipper Chip fight two decades ago, the company is 
saying little in public, and it declined to discuss how the NSA 
entanglements have affected its relationships with customers.
The White House, meanwhile, says it will consider this week's panel 
recommendation that any efforts to subvert cryptography be abandoned.
(Reporting by Joseph Menn; Editing by Jonathan Weber and Grant McCool)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 11189 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131222/be175a00/attachment.txt>

From electromagnetize at gmail.com  Sun Dec 22 14:31:54 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Sun, 22 Dec 2013 16:31:54 -0600
Subject: Vegetation Comsec
In-Reply-To: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
References: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
Message-ID: <CADhsnxcYK4west0wP0uUTcDkSz3U6Az5xYjiExjt+3u6aUea9Q@mail.gmail.com>

<jya at pipeline.com> wrote:

> This raises the prospect of using plant capabilities in
> emissions of chemicals and finding nutrients in signaling,
> SIGINT, comsec, infosec and crypto.
>
> Has anyone seen reports on this? Or on chemical transceiving
> for comsec? Public key as a plant with unique biological
> identity which absorbs or emits decrypt signal? The use of insect
> and chemical proxies?

i think this is actually the model for human beings as conceived
in long ago times, though may be mistaken. in the Middle Ages
or thereafter, the nervous system itself was medically illustrated
as a plant, held within the watery container of the liquid body, in
this way, in the abstract, not unlike a jellyfish with mobile ocean

// sidenote: could not find visual examples except these: [0]...

again, if memory serves, perhaps it was Plato who described
also the nature of thought in terms of the brain, its enlightenment,
whereby the roots of the nervous system flower into an open mind
which receives light and nourishment from truth, tracking it this way
as flowers situate themselves according to environment, nutrients

so the idea of 'plants' and ~enlightenment, 'knowing' as this relates
to truth and essentially grounding informational and physical realms,
perhaps some kind of natural alignment taking place, harmonization
that is organic, an aspect of ecological foundation and its circuitry,
potentially then scaled to the cosmos, especially with regard to the
theories of origins via panspermia [1], ye olde mushroom astronauts,
delivering life onto earth via asteroid or comets, seeding the oceans;
in this way, sentience of octopus, dolphins, their social intelligence
and awareness, consciousness, alike with jellyfish, as if homologue
with pre-embedded state of nervous system for humans, in vitro (?)
prior to final packaging of mammalian biped and adjustable thumbs

the idea that all life moves towards higher consciousness and that
intelligence and this yearning motivation for greater truth is life, its
force, the trajectory of the grand design from nano- to macro-scale,
issues of culture, freedom, war, occurring at all scales, to survive,
conquer, for what means and ends, what principles, or darkness if
bounded by the false, those who serve it, obey it as if the master.

here cybernetic feedback likewise at all interconnected levels else
its incapacitation, making the living captive to those ceasing to live,
to grow, to evolve beyond existing constraints, limited beliefs, ideas.
the fix of ideology the danger, wrong assumptions and modeling or
subversion of view and awareness to contain, trap, mislead, control

so the idea of information related to intelligence connected with this
condition of LIFE, perhaps related also to plants and awareness, of
a natural condition of sentience even, perhaps, as biome, as with
the Gaia hypothesis of earth as supraorganism, living entity unto
itself as a larger totality or 'living ecosystem', [2] Earth as being.

i think also the book A Guide for the Perplexed delved into this
area in terms of a progression of life, from mineral to vegetable to
animal to human. [3] if not mistaken, from evaluating the wikipedia
page, the issue of nesting exists in that each higher form of life has
within it those underneath it; thus the human is inextricably related
to the mineral, vegetative, animalistic, of which they are composed,
as this also effects consciousness, awareness, and intelligence [4]

a personal experience about this issue of 'living ecosystems' that
themselves may have a larger awareness or consciousness than
just the part -- say, a forest as a supraorganism that is sentient...

(developed a close connection and friendship with a wild deer and
learned how to communicate with her. then observed behavior in
various settings, role of muteness, listening, scent, wind, shiny
objects, distance, motion, fear, nutrition, locomotion, etc. and
when relocating the deer into a more wilderness environment,
it became apparent how she was one-with-the-environment in
a way that an urban park did not allow, as if in wrong circuitry;

deer can basically disappear within a few feet in a forest, and
be totally silent at the same time as observing you searching
for them or just moving past, through their domain. then in the
effort to communicate, connection with camouflage and trees
and leaves helped realize how antlers are very much like sticks,
and how 'eyes' on trees, openings in the bark, are like those of
deer and other animals watching or monitoring the area, each
connected to the others, as part of a larger connected system.
as if all eyes of the forest even. part of a larger awareness and
knowing this, having this as consciousness, shared circuitry.

in other words the deer is the forest, the forest is the deer,
the tree is the deer, the deer is the tree, a hidden symbiotic
relation or structural connectivity that goes beyond one entity
or one life, and spans across them as a larger, longer relation
as if functioning together, moving in a shared direction, thus
life dependent on other life, in terms of its dynamic circuitry,
then stresses, pressures, motivations occurring against this)

should have also mentioned issues of governance related to
consciousness and intelligence, knowledge and awareness
as they rely on shared structures and foundations (circuitry)
that allow self-sustaining or connected systems to develop
within certain parameters, and thus origin stories of rocks
and minerals connected with cosmological big bang and
development of universe, galaxies, solar system, planets;
this then physics and chemistry, molecules moving into a
realm of organisms, life, and of vegetation and plants, thus
biology, botany, chemistry, horticulture, (if not aspects of
archaeology, paleontology in terms of research & studies),
then into fauna, animals, realm of biology and zoology if
not anthropology, to move into sociology, anthropology,
economics, politics, culture, 'arts', architecture, crypto.

(note here- question of crypto at mineral and vegetable,
not just present-day context of p2p computer exchange)

also note the role of behaviorist science to treat humans
only as animals, lowering their intellectual status via a
limited model of existence to Darwinian framework that
squares humans with apes, not divine entities or origin,
as this relates to loss of empirical truth, logic, reasoning
within society then enforced by universities, psychiatry
in particular, where 'medicine' helps this devolutionary
process occur, in the black arts of political diagnoses
that reverse the alchemical process: lead to gold via
toxic pills that destroy circuitry and the ability to think,
all to uphold a worldview of humans as merely animals,
managed as livestock, routed to holocaust cattle chutes

here, the ideology buttressed by anthropological skulldiggery
and archaeological equivalence, the sociological likewise as
if all are the same, no matter if ascending or descending in
relation to having once previously ascended or descended,
such that apes becoming more human-like, humans more
apelike, humans more humans, apes more and more ape;
and hell, why not reference Planet of the Apes once again
as a context for Lincoln related civil war of said ideology

so behaviorism backed up by 'political sciences' as cult,
as this translates into a dumbing-down and enforcement
of status quo dynamics, moving from human to the animal,
vegetable, & mineral, the more robotic, base the interactions

and so consciousness, awareness, intelligence, communication
becoming less and less overt time, bounded by psychiatric limits
of what that is perceptible is acceptable in given frameworks, the
'brain police' monitoring everyone as potentially out of control apes,
this slavery, contained within a ideology that has become the state,
requires certain beliefs and conformance to illusory representations
and obey is the only option- or else, there goes your mind & body

biome again, people living in toxic realm, despoiled environment
then forcibly adapted to it if not by peer pressure as selection,
the most unfit and mediocre the champions and successors in
wasteland, just follow brain-dead rules of the machine to survive;

(if that does not work, take these pills and start behaving or else;
children as young as 2 y.o. being dosed by psychiatrists to rewire
troubled beings in such a hellhole, killing off any chance of survival
before turning completely bonkers when cerebrum lights all at once,
essentially programming population of mind-controlled psychopaths;
forgot implant antenna, deranged psych pills enough to circuit design)

so peoples in mental institutions often referred to as vegetables,
as with those brain dead in hospitals, else comatose, operating or
existing in a realm beyond. catatonia, etc. as this tends also to a
realm of mootness, or otherness, perhaps related to the autistic,
of a bounded or limited realm where communication is not occurring
yet should be or once did, those somehow is miswired or rewired
and thus the circuits are not connected or integrated to enable
the internal/external relation, as if person trapped inside the self
and how this relates to communication and balancing, processing
of stimuli, how to make sense of what is going on, especially if
living in a frenetic world that does not make sense to begin with

the correlation to this general condition (it as nausea, malaise)
is a Spore-like entity that can function as essentially brainless,
mindless, and make-do and make-their-way in the labyrinth as
if dungeon master granted special powers and abilities. this is
The Beast known as feelings-only, who matches phase change
and state to what is liked and not liked, what makes happy or
sad or mad, mediating existence on these immediate terms
without capacity, depth, or willingness to consider beyond this
quasi-emotional framework, detached from larger grounding in
surrounding truth, such that judgement can be immediate as
to sensory perception, yet also disconnected from the larger
reality, and instead function as delusion state of being and
mistaken awareness. these people become MANAGERS
(a joke here), many times. and compliance to rules, other
beliefs in a too-simple and stupidistic mindset/framework
then orchestrates and elevates the dumb to supremacy as
'true believers' in the warped model, because of its benefits
to them and their kind, without further question or insight;
just following, enforcing, repeating, extending mediocrity

when these types become teachers, in autocratic status-
based hierarchy, 'truth' is legislated by likable beliefs and
those unliked, disfavored, easily censored based on moral
belief in superiority of this lesser and base existence and
way of being and 'thinking' as if a more limited animal, in
that the human becomes a trained ape by such relation,
as it becomes education, career, 'voting', and otherwise

so, choosing to be vegetable, choosing that path, and
communicating or scenting and signaling in that realm,
procreation, spawning more of such kind automatically,
housing, feeding, schooling, refining a given production
to enable such a mindless population to manage us,
the lower then determining actions of those higher in
a realm of functioning, awareness, ideas, capacities;
and because politically correct, illegal to say anything
against this for fear of upsetting those benefiting from it


another aspect is drug culture in the supposedly non-legal
domain though also hypocritically mainstream, thus law
does not apply if favored, yet is used to imprison others
unprotected. professional drug users staying out of prison,
others with any infraction that threaten the state: goodbye

then moralizing about anything from this perspective as if
universal quite problematic, if only for the massive bullshit
factor it involves on a corrupt societal scale, prophets of
counterculture too many to list, though enough shithead
musicians represent into the present day, so it becomes
unnecessary- just turn on media and see the idiots posing
as if enlightened, encultured to wasteland as peak, ideal
instead of base, bottom-feeding, making profit from shit


within this context of counterculture, drug zeitgeist the
counter pendulum to rise of psychiatric and its duplicity,
the structural connection and association with 'new age'
of consciousness, awareness, philosophical beliefs and
questioning of principles, religious, spiritual, every other

so quaaludes and acid trippers reach top of mountain as
Moses' and then fall all the way back down again, repeat
this thousands and millions of times, the more piling on,
and this too a search for enlightenment for many, if not
of destroying the self in order to find the self once again,
the displacement then involving recentering, and a way
into questioning and other way and types of knowing

the problem is that it is removed of its depth, grounding
as ritual and of potential spiritual practice and instead
can function in a realm of the base and profane, and
thus tends towards devolutionary processes rather
than the opposite, indicating growth beyond existing
boundaries, not just in a single realm, though overall,
in the total circuit. for example, you could be in bliss
temporarily yet residing in a shithole for the rest of life
and it may not balance out or move beyond this or
even be able to be sustained, the destructive cycle
where drugs can short-circuit via near-term fixes
for longer-term problems, larger situations beyond
the self, yet drugs can entrap people in their own
smaller worldviews, create boundaries not open up
connections, and rely on synchronizing with sickness
and toxic conditions and become further a part of
its structure, the downward force and momentum,
yet not accounted for this way, taken out of context

that is the bullshit about too-easy enlightenment,
that it is in the pill and not in the self to begin with,
and about access and unlocking and not substituting
a life for a parallel condition existing outside or beyond
it, no longer responsible or responsive to surroundings,
then becoming this ecosystem, eyes and ears of the
drug even, which is the larger point of the vegetative

people becoming cocaine, becoming heroine, they
as if plants, the awareness of 'like=like' then mapping
into consciousness with others and hidden subculture,
knowing who is within a similar domain or functioning
based on subtle clues and intelligence and signaling

who has gone far into the void, who knows what you
know or has seen what you have seen. what kinds of
knowledge, misery, motivations, betrayals, violence,
deceptions. what kind of treachery hangs in the air
as a potential, what parameters or dimensions exist
in superposition that given nearby circuitry could alight


this can be a realm of seers and sages and prophecy,
of intelligence if grounded, connected to ideas, yet it
can as easily lead into babble and vacancy of truth
beyond the illusion, lead astray into further falsity,
and thus how a person is grounded then influences
how drugs effect and their mediation, what results

this could be a healthy controlled practice that is
medicinal and rite-of-passage, or it could lead towards
loss of greater truth or purposes, and people instead
devolving to the drug, becoming trapped, encrypted
in its domain, surrogate yet also societal parasite
doing bidding of forces subhuman, antihuman even
as organisms seek to control and define territory as
ecosystem, the orchid keeping insects alive for its
own good, drugs governing others nervous systems

the plague of their effectiveness is not only in body,
it is also in the brain and mind, where drugs can limit
sensory considerations into a narrow range and thus
'intelligence' can become confined to a smaller world
and view as ecosystem that relies on false constraints
required for the ecosystem to function as it already does
thus institutionalizing what can be inequalities or biases
or injustices to sustain what is a false-consciousness
at the universal level it may be perceived or believed,
in some sense artificial or unnatural, unreal, a fiction
yet inside this circuitry, it may be 'the most real reality'


consider the human entity as circuit, the nervous system
having a spinal column mapping nerves, sensory feedback
of body into brainstem and 'mind', the capital of the column

consider this is a platform for development, and how any
nutrients or vegetation or carnivore activity then influences
this system in its functioning, the parameters it exists and
sustains itself within, in terms of its governance as scaled
to a larger shared relation with others, in structural terms
(ie the state). thus, any atoms and molecules that go into
this feedback-based system have certain functioning that
result in how it all relates, the dynamics of interaction and
exchange, where truth resides and how it is processed,
not totally unlike a pinball game in its tallying of points

so, if eating some minerals, say having water from a
spring, there could be iron in the water that effects how
a person functions, like vitamins, which then programs
certain cells or influences function, say in regard to blood
somehow or various organs that process these nutrients
or manage those parameters as part of total metabolism

water and humans create a circuit. water is a circuit and
humans are a circuit and together they combine. and it
goes into ecosystems, clouds, environment, ground,
such that if the land is toxic the water is likely effected
and thereby the person, even if in trace amounts, as part
of how the larger ecosystem is balanced, finds alignment
and adjusts or adapts or deteriorates in given dynamics,
perhaps a person becomes ill from lead in the water, etc

likewise, leafy greens in a salad as circuitry, food, and
meat, say from a cow, as this relates to how ingredients
used for daily diets effect and are effected by a larger
circuit, of self though also of groups of people, the state
they together compose, and the environment itself as a
part of this relationship, dynamic, in existing dimensions;
how these are or are not accounted for, then, precluding
what is tallied or 'acknowledged' and in what ways, else
denied, say chemicals on plants that promote cancer
via homeopathic approach, poisoning via 1,000 disease
vectors to eventually hit the genocide jackpot over time;
so too, raising cattle in debilitating conditions, injecting
with hormones to negatively effect humans down range,
eating spiked levels of animal stress and pain as circuit,
perhaps losing nutrition though gaining the amplification
of similar disease promotion via chemical absorption
into cells, their malfunctioning, all part of the plan

this as circuitry, toxic ecosystem functioning against
LIFE, devolving humans to livestock yet vegetable and
eventually robots via very same ideology of technique
removed of higher truth than what is politically allowed,
thus allowing social, behavorial, mental-engineering to
head towards this as if nirvana, 'enlightened following'
where greatest capacity is equated with end of cycle
of existence, by way of extinction of human 'species';
and it is legislated no less. how stupid do people have
to be to go along with it, especially unthinkingly, without
resistance or taking it on as a situation... why is there
an absence of intelligence in dealing with the basics
here, why the gap? perhaps everyone is stoned and
playing games on their fucking iphones, using PGP
to complain about how crooked things are, IDFK

and yet enlightened, opinionated, at same time helpless,
pathetic, yet self-righteous as if superior awareness or
knowing while incapacitated and unwilling to take the
leap into the maw of death enough to trust greater truth,
that the purpose is much larger than any person and that
an infrastructure exist, nature itself, to remedy this situation
beyond all the lies, and yet there is lack of faith or belief--
in truth. in logic. in reality beyond a limited warped view
reliant on relativism, the lies and betrayals of education
becoming commonplace as viewpoint, turned against self,
people cannot even trust their own minds, so thoroughly
mistaken and beholden to external validation of what is

so basically, the individual is fucked. the shared set of
people absolutely absent from engaging the situation in
the terms it exists, beyond the self and small groups
that still can rely upon and benefit from the bullshit factor
and various other limits, impeding larger ecosystem truth,
being that is beyond existing boundaries or misconceptions

then it is a time of count of be counted, who is awake
and who is aware and who serves truth and is willing to
make sacrifices and who are those doing it already and
how is this all connected in a larger structural framework,
as it relates individual awareness in varying dimensions with
others, molecular processing of interconnected consciousness
and where does mind meet its embodiment, deeds, not only
words, and at what scale or what limitation, what amount of
self-serving bullshit and privilege versus sacrifice, losing the
egostic framework that requires its own safety to persist,
disconnection from suffering as if above, instead corrupted
and serving self firstly and projecting this outward to others;
unaccounted for, how much betrayed by the psycho-logical,
a great many tells exist for parameters that remain para-
and thus insight can tend towards involution, yet warped
and ungrounded, as if superior knowing when actually less

thus is the nature of the egotist who believes because of
station to know everything, even though wrongly, while
mocking another who thinks they know something, as if
that is the arrogance and an impossible, due to superiority


on these themes then, there are people who journey into
a realm of drugs and document their research, such as
ethnobotanist Terrance McKenna, [5] and this tends also
towards Thompson-Leary cryptography, [6] in that it is not
only the signaling of plants themselves though their effects
within people and culture, which extends this signaling at
human scale and in human dynamics and ecosystems,
that could be sacred or profane, given implementation
though perhaps also more than this: toxic and poison
exists and being able to absorb it can deteriorate not
enhance in the ways believed as if all is transcendent,
or like climbing mountains, leads to heights not depths;
(if living in an inverted world, things may be backwards)


(note here: as with crystals and piezo-sensors as organic
or natural circuitry, the chemical compounds and circuitry
of drugs, both those defined legal and illegal [7][8], as it
relates to how that circuitry, visualized, may correlate with
certain dimensions and parameters of its effects, in that
the different visual structure maps to different systems in
the body and mind, different ecosystems or dynamics.

thus, like a custom programmed IC or microcontroller,
so too Aspirin or Ambien or Acid or patterns delivered.
in other words: where's the message, what is the key,
where is the information, what is encrypted, how is this
circuitry, how does it map, metabolize, transform and
change, positive and negative dynamics, feedback...

and not to forget, all of this as language, its calculus)


principles and intelligence related to horticulture, then,
Luther Burbank's work The Training of the Human Plant
[9] as this could relate to culture, cultivation, the cultic
imagination and manifestation, of ideas and of ideology

if raising the vegetable as higher consciousness and
becoming one with nature, it could also involve loss of
certain critical facilities or awareness in turn, and this
could be a danger for a way of being that no longer is
human, or no longer serves a higher truth than what is
accessed immediately and in proximity to the body
in terms of its likes and agreements and hospitalities,
and a movement away from truth or regression could
occur, and thinking could be turned against itself so
that the lower is again the higher, people in service
to something that is less intelligent, though in this
way, combining with the circuit, ecosystem, fusing
and then becoming vegetable, animal. in terms of
rites-of-passage, this may be inherent, as with an
embryological view of reptile, mammalian sections
of brain as it develops, old brain and new, and yet,
to then situate a self in a limiting framework and
obey its constraints could also be to decouple
from the natural world for an illusion replacing it,
a false consciousness believed as if higher truth

here be witchcraft and paganism and other forms,
cannibalism and other practices likewise that can
operate in such physics though also in exploitation
not recognize or serve other truths, this danger of
losing the human, turning to falsity as power. and
thus 'humans as plants' turns to 'plants as human'
and another framework of ethics, morality, judgement
and ways of being potentially aligned in other terms

thus people occupy these realms, some witchcraft
dark and serving against truth, while others good
and using knowledge of nature and its metaphysics
for life, healing, medicine, the paradoxical condition,
the Caduceus [10] and Rod of Asclepius [11], their
dual-role of sickness and health, the importance of
being able to recognize its value and not outlaw it,
the truth involved, yet to do so accurately, clearly,
accounting for actual conditions and not ideological,
which then infects minds, corrupts intelligence, etc

(a double-dealing War of Drugs that is a hypocritical
onesided takedown of political enemies forbids this
yet exploits the condition to retain silence, or else
the NSA will ruin your life and quicken extinction.
this is how evil gets a foothold in society, becoming
governance, people obeying and serving this falsity)


so, what say you to worshiping mandrake root? [12]

"i'm up for it, do you have coke to go along with it?"


perhaps tending to profane here... people becoming this
drug, its deliverance as plague even, as consciousness
that is skewed and distorted and worms its way further
into culture via principles aligned with toxic dynamics,
becoming ecosystem, way of being turns to nothingness.
the void, a mirror-image of knowing that is actually false,
ungrounded in its symmetrical belief, incorrectly aligned
with events yet not accounting for structural aberrations
and therefore ignorance a basis of such supreme belief,
as if above it all, operating in a realm of higher awareness
when instead a conceit that does not correlate with reality
and eventually, to be accounted for in cosmic ecosystem

what this is to suggest is that, people becoming plants
is a devolutionary process, a regression of intellectual
capacity that returns to feeling-based diagnostics that
can be localized out of other dimensional frameworks
that were once connected, coherent, and correlated

as lies and falsity are normalized, toxic poison of mind
that is shared amongst many can, like invasive species
overtake localities, growing and thriving in place of the
natural habitat, with devastating consequence for the
prospects of life on terms against the ecosystem, or
ecosystem engineered to be against sustaining of life,
these destructive principles of death and hate, turning
people into lower lifeforms, humans as subhumans, as
if only apes or less than this even, judged, sentenced
to death via this insane and evil ideology, this artifice,
unaligned, disconnected, hostile to nature, life, love


> An amusing account is that of a CIA polygrapher claiming
> to exchage signals with plants, discovered by hooking up
> a polygraph to them. He said he could just think of burning
> a nearby plant for the plant to initiate defenses. His claims were
> later discounted but remind of the long-running mind control
> research by US and Russia. And the unkillable kudzu of
> lie detectors.

then it should be mentioned- turning this into religion...

use of what seems to be a multimeter to diagnose the
human in its electromagnetic circuitry, as lying plant,
though to question Scientology methodology, if this
fever graph is mapping of galvonic skin response or
perhaps 'information' in its vibrational context, as the
circuits would be different, and perhaps another layer
or boundary of interpretation exists between these, in
that non-acoustic acoustic phenomena could be judged
as acoustic, or non-acoustic as electromagnetic yet the
circuits evaluated could be too simple for what is involved
and thus the problem of thinking, of logic and reasoning
in relativistic frameworks that could tend towards rule
of behaviorism _over mind, over higher awareness and
in this way- the rule of language over people, so that
ideas must conform to a given rationalization, ideology
that can be wrong-headed or wrong-minded or of wrong
or inaccurate beliefs yet unchecked as ecosystem and
in this way, mislead or rely on certain 'limited knowing'
versus actual understanding or comprehension beyond
a given faulty framework, where short-circuiting could
be the key to health and not just sickness, correcting
every anomaly leading to forced silencing, versus the
role of sensors, the diagnostic evaluation, clues that
map out circuitry yet not necessarily in their entirety,
the mystery much larger than any parts combined,
when disconnected from ecosystem as if controlled;
the false consciousness default if methodologically
forcing such truth, grounding to the false all too easy,
perhaps the main sickness of institutions over time,
corruption from reliance on ideas divorced from truth
beyond narrowed limits, losing self-awareness while
representing it as if pillar or structure, foundation for
others, symbolic, yet still potentially ungrounded,
the problem of being blinded from believing to know
and yet in this belief, forbidding such awareness

in other words, once again, attaining grounding in
an unnatural or toxic habitat, as this potentially can
relate to lies or falsity, and then 'enlightenment' by
the normalization of this ecosystem relation that
can function in negative, hostile, immoral relations
and dynamics for food, survival, shelter, knowledge,
then going on to represent and replace culture that
was to serve life and now is about serving death and
a certain range of parameters, dimensions, dynamics
that are 'healthy' and 'good' for this diseased condition
and its state of being that is centered on nothingness,
no higher goals than the base and material exploitation

crypto in this context, signaling, as patterns and signs,
symbols and their processing, relations based on these,
correlation between circuitries, issues of competing biomes
and ecosystems, different if hidden ecosystems, ecologies,
different mechanisms and dynamics, as this maps onto
forms, artifacts, events, to be read/written as language,
the correlation of dimensions, shared or unshared, like
or unlike, those who are vegetable-like feeling-based if
not connected with the false world and the oppression,
versus those thinking beyond, into/from other principles-
all of it as circuitry, consciousness, signaling, codes,
crypto, messaging and communications, protocols,
layers, habitat, food, poison/medicine, culture, flow

what is the greater consciousness of the false order?

perhaps the shared lie as it maps to realms of artifice

what is the greater consciousness of truth?

perhaps shared being in the world, truth, live, love

in this way, two entities and existences, information
and its circuits grounding either to truth or to falsity

(the paradox: never beyond a realm of good and evil)


0. [images] humans as plants (visual correlation)
http://medanatomy.wordpress.com/2013/01/14/41/
http://medanatomy.wordpress.com/2013/01/14/37/

1. Panspermia
http://en.wikipedia.org/wiki/Panspermia

2. Gaia hypothesis
http://en.wikipedia.org/wiki/Gaia_hypothesis
http://en.wikipedia.org/wiki/Gaia_%28mythology%29

3. A Guide for the Perplexed
http://en.wikipedia.org/wiki/A_Guide_For_The_Perplexed

4. ibid. Levels of Being (equations)
http://en.wikipedia.org/wiki/A_Guide_For_The_Perplexed#Levels_of_being

5. Terence McKenna
http://en.wikipedia.org/wiki/Terence_McKenna
http://en.wikiquote.org/wiki/Terence_McKenna

6. crypto-p.wd
https://cpunks.org/pipermail/cypherpunks/2013-September/000871.html

7. The Molecular Expressions Pharmaceuticals Collection
http://micro.magnet.fsu.edu/pharmaceuticals/

8. recreational drugs under the microscope
http://www.itsnicethat.com/articles/drugs-on-film-negatives

9. The Training of the Human Plant (pdf/html)
http://joytoyou.com/tothp/Default.htm

10. Caduceus
http://en.wikipedia.org/wiki/Caduceus

11. Rod of Asclepius
http://en.wikipedia.org/wiki/Rod_of_Asclepius

12. MANDRAKE IN PROFILE
http://fog.ccsf.cc.ca.us/irazumov/lectures/illustration/botanical/interesting/medieval.jpg
http://www.fs.fed.us/wildflowers/ethnobotany/mindandspirit/images/solanaceae/Mandragora_humans_lg.jpg
http://www.fs.fed.us/wildflowers/ethnobotany/mindandspirit/mandrake.shtml
http://www.sacredearth.com/ethnobotany/plantprofiles/mandrake.php

13. 12hr-ISBN-JPEG Project
http://4.bp.blogspot.com/-vaZrBgbAi3w/UrVNgLuwFVI/AAAAAAAAfZ4/AubiulMgqZ0/s1600/12hr-767922.jpeg




From coderman at gmail.com  Sun Dec 22 17:01:41 2013
From: coderman at gmail.com (coderman)
Date: Sun, 22 Dec 2013 17:01:41 -0800
Subject: Exclusive: Secret contract tied NSA and security industry pioneer
In-Reply-To: <3410A485C5C5162835047295@F74D39FA044AA309EAEA14B9>
References: <1387757037.30263.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <3410A485C5C5162835047295@F74D39FA044AA309EAEA14B9>
Message-ID: <CAJVRA1Rjps0-EAUfEbUafWGRBX=AALUjuV44zZsTH+0_a58Obg@mail.gmail.com>

On Sun, Dec 22, 2013 at 4:19 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
>...
>         I just occured to me. These fine gentlemen named their criminal
> organization, I mean, their admirable firm, R-S-A as some kind of joke(that
> is on them), or to make it clear who they work for?


 https://twitter.com/RSAConference/statuses/413715675891634176

they've done the research. they're in good company!

*cough*




From coderman at gmail.com  Sun Dec 22 17:11:29 2013
From: coderman at gmail.com (coderman)
Date: Sun, 22 Dec 2013 17:11:29 -0800
Subject: private sector privacy enhancing technology transition for
 disillusioned IC employees
Message-ID: <CAJVRA1TJ2DbfXNLPZP8Jn7Q8q1u-vau1w2Tunp2-VAO9af2KKw@mail.gmail.com>

if DEA finds meaningful work in legal marijuana[0], will IC community
find meaningful work red teaming and supporting privacy enhancing
technologies and usable open source crypto?

knowing how to break things useful in building systems that are harder
to break...



0. "DEA agents finding greener jobs in lucrative legal marijuana industry"
   http://blog.oregonlive.com/portland_impact/print.html?entry=/2013/12/dea_agents_finding_greener_job.html




From jya at pipeline.com  Sun Dec 22 15:35:40 2013
From: jya at pipeline.com (John Young)
Date: Sun, 22 Dec 2013 18:35:40 -0500
Subject: Vegetation Comsec
In-Reply-To: <CADhsnxcYK4west0wP0uUTcDkSz3U6Az5xYjiExjt+3u6aUea9Q@mail.g
 mail.com>
References: <E1VuCCO-0005P6-6I@elasmtp-mealy.atl.sa.earthlink.net>
 <CADhsnxcYK4west0wP0uUTcDkSz3U6Az5xYjiExjt+3u6aUea9Q@mail.gmail.com>
Message-ID: <E1VusXR-00083T-Ao@elasmtp-masked.atl.sa.earthlink.net>

A characteristic of plants is that because they expect to
be eaten, they do not have vital organs, and regenerate
parts taken.

Thus, if a ciphersystem expected to be broken, it might
be able to mend the break, sacrifice parts to protect the
whole, without disclosing full content.

Surely there is a sytem that already does this. Multi-level
security may be close.

That a plant cannot move but depends upon absorbing
nutrients in its locale or delivered by movable actors --
insects, wind, rain, animals, other plant seeds -- might
also suggest a way to protect static machines and
networks.

Surely that is being done.

In both cases parts are sacrificed to movable actors who
are deluded to believe they rule over lesser beings which
they cannot understand.

So where are the eatable broken crypto which regenerates
itself without giving up full content, and networks which
are protected by use and traffic passing through? Tor might
be close to the latter for protecting content but the
hardware remains vulnerable.




At 05:31 PM 12/22/2013, you wrote:
><jya at pipeline.com> wrote:
>
> > This raises the prospect of using plant capabilities in
> > emissions of chemicals and finding nutrients in signaling,
> > SIGINT, comsec, infosec and crypto.
> >
> > Has anyone seen reports on this? Or on chemical transceiving
> > for comsec? Public key as a plant with unique biological
> > identity which absorbs or emits decrypt signal? The use of insect
> > and chemical proxies?
>
>i think this is actually the model for human beings as conceived
>in long ago times, though may be mistaken. in the Middle Ages
>or thereafter, the nervous system itself was medically illustrated
>as a plant, held within the watery container of the liquid body, in
>this way, in the abstract, not unlike a jellyfish with mobile ocean
>
>// sidenote: could not find visual examples except these: [0]...
>
>again, if memory serves, perhaps it was Plato who described
>also the nature of thought in terms of the brain, its enlightenment,
>whereby the roots of the nervous system flower into an open mind
>which receives light and nourishment from truth, tracking it this way
>as flowers situate themselves according to environment, nutrients
>
>so the idea of 'plants' and ~enlightenment, 'knowing' as this relates
>to truth and essentially grounding informational and physical realms,
>perhaps some kind of natural alignment taking place, harmonization
>that is organic, an aspect of ecological foundation and its circuitry,
>potentially then scaled to the cosmos, especially with regard to the
>theories of origins via panspermia [1], ye olde mushroom astronauts,
>delivering life onto earth via asteroid or comets, seeding the oceans;
>in this way, sentience of octopus, dolphins, their social intelligence
>and awareness, consciousness, alike with jellyfish, as if homologue
>with pre-embedded state of nervous system for humans, in vitro (?)
>prior to final packaging of mammalian biped and adjustable thumbs
>
>the idea that all life moves towards higher consciousness and that
>intelligence and this yearning motivation for greater truth is life, its
>force, the trajectory of the grand design from nano- to macro-scale,
>issues of culture, freedom, war, occurring at all scales, to survive,
>conquer, for what means and ends, what principles, or darkness if
>bounded by the false, those who serve it, obey it as if the master.
>
>here cybernetic feedback likewise at all interconnected levels else
>its incapacitation, making the living captive to those ceasing to live,
>to grow, to evolve beyond existing constraints, limited beliefs, ideas.
>the fix of ideology the danger, wrong assumptions and modeling or
>subversion of view and awareness to contain, trap, mislead, control
>
>so the idea of information related to intelligence connected with this
>condition of LIFE, perhaps related also to plants and awareness, of
>a natural condition of sentience even, perhaps, as biome, as with
>the Gaia hypothesis of earth as supraorganism, living entity unto
>itself as a larger totality or 'living ecosystem', [2] Earth as being.
>
>i think also the book A Guide for the Perplexed delved into this
>area in terms of a progression of life, from mineral to vegetable to
>animal to human. [3] if not mistaken, from evaluating the wikipedia
>page, the issue of nesting exists in that each higher form of life has
>within it those underneath it; thus the human is inextricably related
>to the mineral, vegetative, animalistic, of which they are composed,
>as this also effects consciousness, awareness, and intelligence [4]
>
>a personal experience about this issue of 'living ecosystems' that
>themselves may have a larger awareness or consciousness than
>just the part -- say, a forest as a supraorganism that is sentient...
>
>(developed a close connection and friendship with a wild deer and
>learned how to communicate with her. then observed behavior in
>various settings, role of muteness, listening, scent, wind, shiny
>objects, distance, motion, fear, nutrition, locomotion, etc. and
>when relocating the deer into a more wilderness environment,
>it became apparent how she was one-with-the-environment in
>a way that an urban park did not allow, as if in wrong circuitry;
>
>deer can basically disappear within a few feet in a forest, and
>be totally silent at the same time as observing you searching
>for them or just moving past, through their domain. then in the
>effort to communicate, connection with camouflage and trees
>and leaves helped realize how antlers are very much like sticks,
>and how 'eyes' on trees, openings in the bark, are like those of
>deer and other animals watching or monitoring the area, each
>connected to the others, as part of a larger connected system.
>as if all eyes of the forest even. part of a larger awareness and
>knowing this, having this as consciousness, shared circuitry.
>
>in other words the deer is the forest, the forest is the deer,
>the tree is the deer, the deer is the tree, a hidden symbiotic
>relation or structural connectivity that goes beyond one entity
>or one life, and spans across them as a larger, longer relation
>as if functioning together, moving in a shared direction, thus
>life dependent on other life, in terms of its dynamic circuitry,
>then stresses, pressures, motivations occurring against this)
>
>should have also mentioned issues of governance related to
>consciousness and intelligence, knowledge and awareness
>as they rely on shared structures and foundations (circuitry)
>that allow self-sustaining or connected systems to develop
>within certain parameters, and thus origin stories of rocks
>and minerals connected with cosmological big bang and
>development of universe, galaxies, solar system, planets;
>this then physics and chemistry, molecules moving into a
>realm of organisms, life, and of vegetation and plants, thus
>biology, botany, chemistry, horticulture, (if not aspects of
>archaeology, paleontology in terms of research & studies),
>then into fauna, animals, realm of biology and zoology if
>not anthropology, to move into sociology, anthropology,
>economics, politics, culture, 'arts', architecture, crypto.
>
>(note here- question of crypto at mineral and vegetable,
>not just present-day context of p2p computer exchange)
>
>also note the role of behaviorist science to treat humans
>only as animals, lowering their intellectual status via a
>limited model of existence to Darwinian framework that
>squares humans with apes, not divine entities or origin,
>as this relates to loss of empirical truth, logic, reasoning
>within society then enforced by universities, psychiatry
>in particular, where 'medicine' helps this devolutionary
>process occur, in the black arts of political diagnoses
>that reverse the alchemical process: lead to gold via
>toxic pills that destroy circuitry and the ability to think,
>all to uphold a worldview of humans as merely animals,
>managed as livestock, routed to holocaust cattle chutes
>
>here, the ideology buttressed by anthropological skulldiggery
>and archaeological equivalence, the sociological likewise as
>if all are the same, no matter if ascending or descending in
>relation to having once previously ascended or descended,
>such that apes becoming more human-like, humans more
>apelike, humans more humans, apes more and more ape;
>and hell, why not reference Planet of the Apes once again
>as a context for Lincoln related civil war of said ideology
>
>so behaviorism backed up by 'political sciences' as cult,
>as this translates into a dumbing-down and enforcement
>of status quo dynamics, moving from human to the animal,
>vegetable, & mineral, the more robotic, base the interactions
>
>and so consciousness, awareness, intelligence, communication
>becoming less and less overt time, bounded by psychiatric limits
>of what that is perceptible is acceptable in given frameworks, the
>'brain police' monitoring everyone as potentially out of control apes,
>this slavery, contained within a ideology that has become the state,
>requires certain beliefs and conformance to illusory representations
>and obey is the only option- or else, there goes your mind & body
>
>biome again, people living in toxic realm, despoiled environment
>then forcibly adapted to it if not by peer pressure as selection,
>the most unfit and mediocre the champions and successors in
>wasteland, just follow brain-dead rules of the machine to survive;
>
>(if that does not work, take these pills and start behaving or else;
>children as young as 2 y.o. being dosed by psychiatrists to rewire
>troubled beings in such a hellhole, killing off any chance of survival
>before turning completely bonkers when cerebrum lights all at once,
>essentially programming population of mind-controlled psychopaths;
>forgot implant antenna, deranged psych pills enough to circuit design)
>
>so peoples in mental institutions often referred to as vegetables,
>as with those brain dead in hospitals, else comatose, operating or
>existing in a realm beyond. catatonia, etc. as this tends also to a
>realm of mootness, or otherness, perhaps related to the autistic,
>of a bounded or limited realm where communication is not occurring
>yet should be or once did, those somehow is miswired or rewired
>and thus the circuits are not connected or integrated to enable
>the internal/external relation, as if person trapped inside the self
>and how this relates to communication and balancing, processing
>of stimuli, how to make sense of what is going on, especially if
>living in a frenetic world that does not make sense to begin with
>
>the correlation to this general condition (it as nausea, malaise)
>is a Spore-like entity that can function as essentially brainless,
>mindless, and make-do and make-their-way in the labyrinth as
>if dungeon master granted special powers and abilities. this is
>The Beast known as feelings-only, who matches phase change
>and state to what is liked and not liked, what makes happy or
>sad or mad, mediating existence on these immediate terms
>without capacity, depth, or willingness to consider beyond this
>quasi-emotional framework, detached from larger grounding in
>surrounding truth, such that judgement can be immediate as
>to sensory perception, yet also disconnected from the larger
>reality, and instead function as delusion state of being and
>mistaken awareness. these people become MANAGERS
>(a joke here), many times. and compliance to rules, other
>beliefs in a too-simple and stupidistic mindset/framework
>then orchestrates and elevates the dumb to supremacy as
>'true believers' in the warped model, because of its benefits
>to them and their kind, without further question or insight;
>just following, enforcing, repeating, extending mediocrity
>
>when these types become teachers, in autocratic status-
>based hierarchy, 'truth' is legislated by likable beliefs and
>those unliked, disfavored, easily censored based on moral
>belief in superiority of this lesser and base existence and
>way of being and 'thinking' as if a more limited animal, in
>that the human becomes a trained ape by such relation,
>as it becomes education, career, 'voting', and otherwise
>
>so, choosing to be vegetable, choosing that path, and
>communicating or scenting and signaling in that realm,
>procreation, spawning more of such kind automatically,
>housing, feeding, schooling, refining a given production
>to enable such a mindless population to manage us,
>the lower then determining actions of those higher in
>a realm of functioning, awareness, ideas, capacities;
>and because politically correct, illegal to say anything
>against this for fear of upsetting those benefiting from it
>
>
>another aspect is drug culture in the supposedly non-legal
>domain though also hypocritically mainstream, thus law
>does not apply if favored, yet is used to imprison others
>unprotected. professional drug users staying out of prison,
>others with any infraction that threaten the state: goodbye
>
>then moralizing about anything from this perspective as if
>universal quite problematic, if only for the massive bullshit
>factor it involves on a corrupt societal scale, prophets of
>counterculture too many to list, though enough shithead
>musicians represent into the present day, so it becomes
>unnecessary- just turn on media and see the idiots posing
>as if enlightened, encultured to wasteland as peak, ideal
>instead of base, bottom-feeding, making profit from shit
>
>
>within this context of counterculture, drug zeitgeist the
>counter pendulum to rise of psychiatric and its duplicity,
>the structural connection and association with 'new age'
>of consciousness, awareness, philosophical beliefs and
>questioning of principles, religious, spiritual, every other
>
>so quaaludes and acid trippers reach top of mountain as
>Moses' and then fall all the way back down again, repeat
>this thousands and millions of times, the more piling on,
>and this too a search for enlightenment for many, if not
>of destroying the self in order to find the self once again,
>the displacement then involving recentering, and a way
>into questioning and other way and types of knowing
>
>the problem is that it is removed of its depth, grounding
>as ritual and of potential spiritual practice and instead
>can function in a realm of the base and profane, and
>thus tends towards devolutionary processes rather
>than the opposite, indicating growth beyond existing
>boundaries, not just in a single realm, though overall,
>in the total circuit. for example, you could be in bliss
>temporarily yet residing in a shithole for the rest of life
>and it may not balance out or move beyond this or
>even be able to be sustained, the destructive cycle
>where drugs can short-circuit via near-term fixes
>for longer-term problems, larger situations beyond
>the self, yet drugs can entrap people in their own
>smaller worldviews, create boundaries not open up
>connections, and rely on synchronizing with sickness
>and toxic conditions and become further a part of
>its structure, the downward force and momentum,
>yet not accounted for this way, taken out of context
>
>that is the bullshit about too-easy enlightenment,
>that it is in the pill and not in the self to begin with,
>and about access and unlocking and not substituting
>a life for a parallel condition existing outside or beyond
>it, no longer responsible or responsive to surroundings,
>then becoming this ecosystem, eyes and ears of the
>drug even, which is the larger point of the vegetative
>
>people becoming cocaine, becoming heroine, they
>as if plants, the awareness of 'like=like' then mapping
>into consciousness with others and hidden subculture,
>knowing who is within a similar domain or functioning
>based on subtle clues and intelligence and signaling
>
>who has gone far into the void, who knows what you
>know or has seen what you have seen. what kinds of
>knowledge, misery, motivations, betrayals, violence,
>deceptions. what kind of treachery hangs in the air
>as a potential, what parameters or dimensions exist
>in superposition that given nearby circuitry could alight
>
>
>this can be a realm of seers and sages and prophecy,
>of intelligence if grounded, connected to ideas, yet it
>can as easily lead into babble and vacancy of truth
>beyond the illusion, lead astray into further falsity,
>and thus how a person is grounded then influences
>how drugs effect and their mediation, what results
>
>this could be a healthy controlled practice that is
>medicinal and rite-of-passage, or it could lead towards
>loss of greater truth or purposes, and people instead
>devolving to the drug, becoming trapped, encrypted
>in its domain, surrogate yet also societal parasite
>doing bidding of forces subhuman, antihuman even
>as organisms seek to control and define territory as
>ecosystem, the orchid keeping insects alive for its
>own good, drugs governing others nervous systems
>
>the plague of their effectiveness is not only in body,
>it is also in the brain and mind, where drugs can limit
>sensory considerations into a narrow range and thus
>'intelligence' can become confined to a smaller world
>and view as ecosystem that relies on false constraints
>required for the ecosystem to function as it already does
>thus institutionalizing what can be inequalities or biases
>or injustices to sustain what is a false-consciousness
>at the universal level it may be perceived or believed,
>in some sense artificial or unnatural, unreal, a fiction
>yet inside this circuitry, it may be 'the most real reality'
>
>
>consider the human entity as circuit, the nervous system
>having a spinal column mapping nerves, sensory feedback
>of body into brainstem and 'mind', the capital of the column
>
>consider this is a platform for development, and how any
>nutrients or vegetation or carnivore activity then influences
>this system in its functioning, the parameters it exists and
>sustains itself within, in terms of its governance as scaled
>to a larger shared relation with others, in structural terms
>(ie the state). thus, any atoms and molecules that go into
>this feedback-based system have certain functioning that
>result in how it all relates, the dynamics of interaction and
>exchange, where truth resides and how it is processed,
>not totally unlike a pinball game in its tallying of points
>
>so, if eating some minerals, say having water from a
>spring, there could be iron in the water that effects how
>a person functions, like vitamins, which then programs
>certain cells or influences function, say in regard to blood
>somehow or various organs that process these nutrients
>or manage those parameters as part of total metabolism
>
>water and humans create a circuit. water is a circuit and
>humans are a circuit and together they combine. and it
>goes into ecosystems, clouds, environment, ground,
>such that if the land is toxic the water is likely effected
>and thereby the person, even if in trace amounts, as part
>of how the larger ecosystem is balanced, finds alignment
>and adjusts or adapts or deteriorates in given dynamics,
>perhaps a person becomes ill from lead in the water, etc
>
>likewise, leafy greens in a salad as circuitry, food, and
>meat, say from a cow, as this relates to how ingredients
>used for daily diets effect and are effected by a larger
>circuit, of self though also of groups of people, the state
>they together compose, and the environment itself as a
>part of this relationship, dynamic, in existing dimensions;
>how these are or are not accounted for, then, precluding
>what is tallied or 'acknowledged' and in what ways, else
>denied, say chemicals on plants that promote cancer
>via homeopathic approach, poisoning via 1,000 disease
>vectors to eventually hit the genocide jackpot over time;
>so too, raising cattle in debilitating conditions, injecting
>with hormones to negatively effect humans down range,
>eating spiked levels of animal stress and pain as circuit,
>perhaps losing nutrition though gaining the amplification
>of similar disease promotion via chemical absorption
>into cells, their malfunctioning, all part of the plan
>
>this as circuitry, toxic ecosystem functioning against
>LIFE, devolving humans to livestock yet vegetable and
>eventually robots via very same ideology of technique
>removed of higher truth than what is politically allowed,
>thus allowing social, behavorial, mental-engineering to
>head towards this as if nirvana, 'enlightened following'
>where greatest capacity is equated with end of cycle
>of existence, by way of extinction of human 'species';
>and it is legislated no less. how stupid do people have
>to be to go along with it, especially unthinkingly, without
>resistance or taking it on as a situation... why is there
>an absence of intelligence in dealing with the basics
>here, why the gap? perhaps everyone is stoned and
>playing games on their fucking iphones, using PGP
>to complain about how crooked things are, IDFK
>
>and yet enlightened, opinionated, at same time helpless,
>pathetic, yet self-righteous as if superior awareness or
>knowing while incapacitated and unwilling to take the
>leap into the maw of death enough to trust greater truth,
>that the purpose is much larger than any person and that
>an infrastructure exist, nature itself, to remedy this situation
>beyond all the lies, and yet there is lack of faith or belief--
>in truth. in logic. in reality beyond a limited warped view
>reliant on relativism, the lies and betrayals of education
>becoming commonplace as viewpoint, turned against self,
>people cannot even trust their own minds, so thoroughly
>mistaken and beholden to external validation of what is
>
>so basically, the individual is fucked. the shared set of
>people absolutely absent from engaging the situation in
>the terms it exists, beyond the self and small groups
>that still can rely upon and benefit from the bullshit factor
>and various other limits, impeding larger ecosystem truth,
>being that is beyond existing boundaries or misconceptions
>
>then it is a time of count of be counted, who is awake
>and who is aware and who serves truth and is willing to
>make sacrifices and who are those doing it already and
>how is this all connected in a larger structural framework,
>as it relates individual awareness in varying dimensions with
>others, molecular processing of interconnected consciousness
>and where does mind meet its embodiment, deeds, not only
>words, and at what scale or what limitation, what amount of
>self-serving bullshit and privilege versus sacrifice, losing the
>egostic framework that requires its own safety to persist,
>disconnection from suffering as if above, instead corrupted
>and serving self firstly and projecting this outward to others;
>unaccounted for, how much betrayed by the psycho-logical,
>a great many tells exist for parameters that remain para-
>and thus insight can tend towards involution, yet warped
>and ungrounded, as if superior knowing when actually less
>
>thus is the nature of the egotist who believes because of
>station to know everything, even though wrongly, while
>mocking another who thinks they know something, as if
>that is the arrogance and an impossible, due to superiority
>
>
>on these themes then, there are people who journey into
>a realm of drugs and document their research, such as
>ethnobotanist Terrance McKenna, [5] and this tends also
>towards Thompson-Leary cryptography, [6] in that it is not
>only the signaling of plants themselves though their effects
>within people and culture, which extends this signaling at
>human scale and in human dynamics and ecosystems,
>that could be sacred or profane, given implementation
>though perhaps also more than this: toxic and poison
>exists and being able to absorb it can deteriorate not
>enhance in the ways believed as if all is transcendent,
>or like climbing mountains, leads to heights not depths;
>(if living in an inverted world, things may be backwards)
>
>
>(note here: as with crystals and piezo-sensors as organic
>or natural circuitry, the chemical compounds and circuitry
>of drugs, both those defined legal and illegal [7][8], as it
>relates to how that circuitry, visualized, may correlate with
>certain dimensions and parameters of its effects, in that
>the different visual structure maps to different systems in
>the body and mind, different ecosystems or dynamics.
>
>thus, like a custom programmed IC or microcontroller,
>so too Aspirin or Ambien or Acid or patterns delivered.
>in other words: where's the message, what is the key,
>where is the information, what is encrypted, how is this
>circuitry, how does it map, metabolize, transform and
>change, positive and negative dynamics, feedback...
>
>and not to forget, all of this as language, its calculus)
>
>
>principles and intelligence related to horticulture, then,
>Luther Burbank's work The Training of the Human Plant
>[9] as this could relate to culture, cultivation, the cultic
>imagination and manifestation, of ideas and of ideology
>
>if raising the vegetable as higher consciousness and
>becoming one with nature, it could also involve loss of
>certain critical facilities or awareness in turn, and this
>could be a danger for a way of being that no longer is
>human, or no longer serves a higher truth than what is
>accessed immediately and in proximity to the body
>in terms of its likes and agreements and hospitalities,
>and a movement away from truth or regression could
>occur, and thinking could be turned against itself so
>that the lower is again the higher, people in service
>to something that is less intelligent, though in this
>way, combining with the circuit, ecosystem, fusing
>and then becoming vegetable, animal. in terms of
>rites-of-passage, this may be inherent, as with an
>embryological view of reptile, mammalian sections
>of brain as it develops, old brain and new, and yet,
>to then situate a self in a limiting framework and
>obey its constraints could also be to decouple
>from the natural world for an illusion replacing it,
>a false consciousness believed as if higher truth
>
>here be witchcraft and paganism and other forms,
>cannibalism and other practices likewise that can
>operate in such physics though also in exploitation
>not recognize or serve other truths, this danger of
>losing the human, turning to falsity as power. and
>thus 'humans as plants' turns to 'plants as human'
>and another framework of ethics, morality, judgement
>and ways of being potentially aligned in other terms
>
>thus people occupy these realms, some witchcraft
>dark and serving against truth, while others good
>and using knowledge of nature and its metaphysics
>for life, healing, medicine, the paradoxical condition,
>the Caduceus [10] and Rod of Asclepius [11], their
>dual-role of sickness and health, the importance of
>being able to recognize its value and not outlaw it,
>the truth involved, yet to do so accurately, clearly,
>accounting for actual conditions and not ideological,
>which then infects minds, corrupts intelligence, etc
>
>(a double-dealing War of Drugs that is a hypocritical
>onesided takedown of political enemies forbids this
>yet exploits the condition to retain silence, or else
>the NSA will ruin your life and quicken extinction.
>this is how evil gets a foothold in society, becoming
>governance, people obeying and serving this falsity)
>
>
>so, what say you to worshiping mandrake root? [12]
>
>"i'm up for it, do you have coke to go along with it?"
>
>
>perhaps tending to profane here... people becoming this
>drug, its deliverance as plague even, as consciousness
>that is skewed and distorted and worms its way further
>into culture via principles aligned with toxic dynamics,
>becoming ecosystem, way of being turns to nothingness.
>the void, a mirror-image of knowing that is actually false,
>ungrounded in its symmetrical belief, incorrectly aligned
>with events yet not accounting for structural aberrations
>and therefore ignorance a basis of such supreme belief,
>as if above it all, operating in a realm of higher awareness
>when instead a conceit that does not correlate with reality
>and eventually, to be accounted for in cosmic ecosystem
>
>what this is to suggest is that, people becoming plants
>is a devolutionary process, a regression of intellectual
>capacity that returns to feeling-based diagnostics that
>can be localized out of other dimensional frameworks
>that were once connected, coherent, and correlated
>
>as lies and falsity are normalized, toxic poison of mind
>that is shared amongst many can, like invasive species
>overtake localities, growing and thriving in place of the
>natural habitat, with devastating consequence for the
>prospects of life on terms against the ecosystem, or
>ecosystem engineered to be against sustaining of life,
>these destructive principles of death and hate, turning
>people into lower lifeforms, humans as subhumans, as
>if only apes or less than this even, judged, sentenced
>to death via this insane and evil ideology, this artifice,
>unaligned, disconnected, hostile to nature, life, love
>
>
> > An amusing account is that of a CIA polygrapher claiming
> > to exchage signals with plants, discovered by hooking up
> > a polygraph to them. He said he could just think of burning
> > a nearby plant for the plant to initiate defenses. His claims were
> > later discounted but remind of the long-running mind control
> > research by US and Russia. And the unkillable kudzu of
> > lie detectors.
>
>then it should be mentioned- turning this into religion...
>
>use of what seems to be a multimeter to diagnose the
>human in its electromagnetic circuitry, as lying plant,
>though to question Scientology methodology, if this
>fever graph is mapping of galvonic skin response or
>perhaps 'information' in its vibrational context, as the
>circuits would be different, and perhaps another layer
>or boundary of interpretation exists between these, in
>that non-acoustic acoustic phenomena could be judged
>as acoustic, or non-acoustic as electromagnetic yet the
>circuits evaluated could be too simple for what is involved
>and thus the problem of thinking, of logic and reasoning
>in relativistic frameworks that could tend towards rule
>of behaviorism _over mind, over higher awareness and
>in this way- the rule of language over people, so that
>ideas must conform to a given rationalization, ideology
>that can be wrong-headed or wrong-minded or of wrong
>or inaccurate beliefs yet unchecked as ecosystem and
>in this way, mislead or rely on certain 'limited knowing'
>versus actual understanding or comprehension beyond
>a given faulty framework, where short-circuiting could
>be the key to health and not just sickness, correcting
>every anomaly leading to forced silencing, versus the
>role of sensors, the diagnostic evaluation, clues that
>map out circuitry yet not necessarily in their entirety,
>the mystery much larger than any parts combined,
>when disconnected from ecosystem as if controlled;
>the false consciousness default if methodologically
>forcing such truth, grounding to the false all too easy,
>perhaps the main sickness of institutions over time,
>corruption from reliance on ideas divorced from truth
>beyond narrowed limits, losing self-awareness while
>representing it as if pillar or structure, foundation for
>others, symbolic, yet still potentially ungrounded,
>the problem of being blinded from believing to know
>and yet in this belief, forbidding such awareness
>
>in other words, once again, attaining grounding in
>an unnatural or toxic habitat, as this potentially can
>relate to lies or falsity, and then 'enlightenment' by
>the normalization of this ecosystem relation that
>can function in negative, hostile, immoral relations
>and dynamics for food, survival, shelter, knowledge,
>then going on to represent and replace culture that
>was to serve life and now is about serving death and
>a certain range of parameters, dimensions, dynamics
>that are 'healthy' and 'good' for this diseased condition
>and its state of being that is centered on nothingness,
>no higher goals than the base and material exploitation
>
>crypto in this context, signaling, as patterns and signs,
>symbols and their processing, relations based on these,
>correlation between circuitries, issues of competing biomes
>and ecosystems, different if hidden ecosystems, ecologies,
>different mechanisms and dynamics, as this maps onto
>forms, artifacts, events, to be read/written as language,
>the correlation of dimensions, shared or unshared, like
>or unlike, those who are vegetable-like feeling-based if
>not connected with the false world and the oppression,
>versus those thinking beyond, into/from other principles-
>all of it as circuitry, consciousness, signaling, codes,
>crypto, messaging and communications, protocols,
>layers, habitat, food, poison/medicine, culture, flow
>
>what is the greater consciousness of the false order?
>
>perhaps the shared lie as it maps to realms of artifice
>
>what is the greater consciousness of truth?
>
>perhaps shared being in the world, truth, live, love
>
>in this way, two entities and existences, information
>and its circuits grounding either to truth or to falsity
>
>(the paradox: never beyond a realm of good and evil)
>
>
>0. [images] humans as plants (visual correlation)
>http://medanatomy.wordpress.com/2013/01/14/41/
>http://medanatomy.wordpress.com/2013/01/14/37/
>
>1. Panspermia
>http://en.wikipedia.org/wiki/Panspermia
>
>2. Gaia hypothesis
>http://en.wikipedia.org/wiki/Gaia_hypothesis
>http://en.wikipedia.org/wiki/Gaia_%28mythology%29
>
>3. A Guide for the Perplexed
>http://en.wikipedia.org/wiki/A_Guide_For_The_Perplexed
>
>4. ibid. Levels of Being (equations)
>http://en.wikipedia.org/wiki/A_Guide_For_The_Perplexed#Levels_of_being
>
>5. Terence McKenna
>http://en.wikipedia.org/wiki/Terence_McKenna
>http://en.wikiquote.org/wiki/Terence_McKenna
>
>6. crypto-p.wd
>https://cpunks.org/pipermail/cypherpunks/2013-September/000871.html
>
>7. The Molecular Expressions Pharmaceuticals Collection
>http://micro.magnet.fsu.edu/pharmaceuticals/
>
>8. recreational drugs under the microscope
>http://www.itsnicethat.com/articles/drugs-on-film-negatives
>
>9. The Training of the Human Plant (pdf/html)
>http://joytoyou.com/tothp/Default.htm
>
>10. Caduceus
>http://en.wikipedia.org/wiki/Caduceus
>
>11. Rod of Asclepius
>http://en.wikipedia.org/wiki/Rod_of_Asclepius
>
>12. MANDRAKE IN PROFILE
>http://fog.ccsf.cc.ca.us/irazumov/lectures/illustration/botanical/interesting/medieval.jpg
>http://www.fs.fed.us/wildflowers/ethnobotany/mindandspirit/images/solanaceae/Mandragora_humans_lg.jpg
>http://www.fs.fed.us/wildflowers/ethnobotany/mindandspirit/mandrake.shtml
>http://www.sacredearth.com/ethnobotany/plantprofiles/mandrake.php
>
>13. 12hr-ISBN-JPEG Project
>http://4.bp.blogspot.com/-vaZrBgbAi3w/UrVNgLuwFVI/AAAAAAAAfZ4/AubiulMgqZ0/s1600/12hr-767922.jpeg





From adam at cypherspace.org  Sun Dec 22 10:43:30 2013
From: adam at cypherspace.org (Adam Back)
Date: Sun, 22 Dec 2013 19:43:30 +0100
Subject: RSA complicity or not in the EC_DBRG backdoor (Re: Human scum:
 Jim Bidzous of RSA)
In-Reply-To: <CA+cU71mGm253wNgRvA7UKn205=eC_6Z0ORLKJUw+2ex5WvVDrw@mail.gmail.com>
References: <52B56924.7030605@cypherpunks.to> <52B56B05.50002@cypherpunks.to>
 <20131221111358.GB19555@netbook.cypherspace.org>
 <CA+cU71mGm253wNgRvA7UKn205=eC_6Z0ORLKJUw+2ex5WvVDrw@mail.gmail.com>
Message-ID: <20131222184330.GA1519@netbook.cypherspace.org>

Ask Gwen he wrote the OP.  

My response was about the potential complicity not the personnel.  

The bit you quoted that I wrote was me putting a ps to point out that Gwen
mispelt his name (and I saw you wrote Bidzous also below - again I believe
its Bidzos).

Adam

On Sun, Dec 22, 2013 at 01:14:36PM -0500, Tom Ritter wrote:
>On 21 December 2013 06:13, Adam Back <adam at cypherspace.org> wrote:
>> ps I think its Bidzos.
>
>
>I'm confused, but maybe missing something?  The article says:
>
>'''
>The stakes rose when more technology companies adopted RSA's methods
>and Internet use began to soar. The Clinton administration embraced
>the Clipper Chip, envisioned as a mandatory component in phones and
>computers to enable officials to overcome encryption with a warrant.
>
>RSA led a fierce public campaign against the effort, distributing
>posters with a foundering sailing ship and the words "Sink Clipper!"
>
>A key argument against the chip was that overseas buyers would shun
>U.S. technology products if they were ready-made for spying. Some
>companies say that is just what has happened in the wake of the
>Snowden disclosures.
>
>The White House abandoned the Clipper Chip and instead relied on
>export controls to prevent the best cryptography from crossing U.S.
>borders. RSA once again rallied the industry, and it set up an
>Australian division that could ship what it wanted.
>
>"We became the tip of the spear, so to speak, in this fight against
>government efforts," Bidzos recalled in an oral history.
>'''
>
>'''
>RSA, meanwhile, was changing. Bidzos stepped down as CEO in 1999 to
>concentrate on VeriSign, a security certificate company that had been
>spun out of RSA. The elite lab Bidzos had founded in Silicon Valley
>moved east to Massachusetts, and many top engineers left the company,
>several former employees said.
>'''
>
>It seems like Bidzous was out of RSA long before DUAL EC PRNG was even
>proposed, and was in fact campaigning and strategizing against RSA
>while he was there.  Where are references to other accusations or
>behavior?
>
>-tom




From kylem at xwell.org  Sun Dec 22 17:51:24 2013
From: kylem at xwell.org (Kyle Maxwell)
Date: Sun, 22 Dec 2013 19:51:24 -0600
Subject: private sector privacy enhancing technology transition for
 disillusioned IC employees
In-Reply-To: <CAJVRA1TJ2DbfXNLPZP8Jn7Q8q1u-vau1w2Tunp2-VAO9af2KKw@mail.gmail.com>
References: <CAJVRA1TJ2DbfXNLPZP8Jn7Q8q1u-vau1w2Tunp2-VAO9af2KKw@mail.gmail.com>
Message-ID: <CAESvgEo3k=qHGV=7Be5VB5VVzaZ116g+e8RCrGTu229FYu+p8Q@mail.gmail.com>

Honestly, this happens a lot already to varying degrees, and if early
reports about NSA retention rates dropping and personnel churn
increasing can be believed, then perhaps this will happen more.

On Sun, Dec 22, 2013 at 7:11 PM, coderman <coderman at gmail.com> wrote:
> if DEA finds meaningful work in legal marijuana[0], will IC community
> find meaningful work red teaming and supporting privacy enhancing
> technologies and usable open source crypto?
>
> knowing how to break things useful in building systems that are harder
> to break...
>
>
>
> 0. "DEA agents finding greener jobs in lucrative legal marijuana industry"
>    http://blog.oregonlive.com/portland_impact/print.html?entry=/2013/12/dea_agents_finding_greener_job.html



-- 
@kylemaxwell




From kylem at xwell.org  Sun Dec 22 18:15:40 2013
From: kylem at xwell.org (Kyle Maxwell)
Date: Sun, 22 Dec 2013 20:15:40 -0600
Subject: Exclusive: Secret contract tied NSA and security industry pioneer
In-Reply-To: <CAJVRA1Rjps0-EAUfEbUafWGRBX=AALUjuV44zZsTH+0_a58Obg@mail.gmail.com>
References: <1387757037.30263.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <3410A485C5C5162835047295@F74D39FA044AA309EAEA14B9>
 <CAJVRA1Rjps0-EAUfEbUafWGRBX=AALUjuV44zZsTH+0_a58Obg@mail.gmail.com>
Message-ID: <CAESvgEqcrYZXOJCSKo4rtJHenP72AkYXpDrrEupqnVvJ+VKf6Q@mail.gmail.com>

Well, also because of the initials of the founders. So there's that.

On Sun, Dec 22, 2013 at 7:01 PM, coderman <coderman at gmail.com> wrote:
> On Sun, Dec 22, 2013 at 4:19 PM, Juan Garofalo <juan.g71 at gmail.com> wrote:
>>...
>>         I just occured to me. These fine gentlemen named their criminal
>> organization, I mean, their admirable firm, R-S-A as some kind of joke(that
>> is on them), or to make it clear who they work for?
>
>
>  https://twitter.com/RSAConference/statuses/413715675891634176
>
> they've done the research. they're in good company!
>
> *cough*



-- 
@kylemaxwell




From juan.g71 at gmail.com  Sun Dec 22 16:19:23 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Sun, 22 Dec 2013 21:19:23 -0300
Subject: Exclusive: Secret contract tied NSA and security industry pioneer
In-Reply-To: <1387757037.30263.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <1387757037.30263.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <3410A485C5C5162835047295@F74D39FA044AA309EAEA14B9>




	I just occured to me. These fine gentlemen named their criminal
organization, I mean, their admirable firm, R-S-A as some kind of joke(that
is on them), or to make it clear who they work for? 

	


> 
> 
> http://news.yahoo.com/exclusive-secret-contract-tied-nsa-security-industr
> y-pioneer-001729620--finance.html
> 
> 
> By Joseph Menn 
> SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption
> software  that it could crack into widely used computer products, the
> U.S.  National Security Agency arranged a secret $10 million contract
> with  RSA, one of the most influential firms in the computer security 
> industry, Reuters has learned.
> Documents leaked by former NSA contractor Edward Snowden show that the 
> NSA created and promulgated a flawed formula for generating random 
> numbers to create a "back door" in encryption products, the New York 
> Times reported in September. Reuters later reported that RSA became the 
> most important distributor of that formula by rolling it into a software
> tool called Bsafe that is used to enhance security in personal  computers
> and many other products.
> Undisclosed until now was that RSA received $10 million in a deal that 
> set the NSA formula as the preferred, or default, method for number 
> generation in the BSafe software, according to two sources familiar with
> the contract. Although that sum might seem paltry, it represented more 
> than a third of the revenue that the relevant division at RSA had taken 
> in during the entire previous year, securities filings show.
> The earlier disclosures of RSA's entanglement with the NSA already had 
> shocked some in the close-knit world of computer security experts. The 
> company had a long history of championing privacy and security, and it 
> played a leading role in blocking a 1990s effort by the NSA to require a
> special chip to enable spying on a wide range of computer and 
> communications products.
> RSA, now a subsidiary of computer storage giant EMC Corp, urged 
> customers to stop using the NSA formula after the Snowden disclosures 
> revealed its weakness.
> RSA 
> and EMC declined to answer questions for this story, but RSA said in a 
> statement: "RSA always acts in the best interest of its customers and 
> under no circumstances does RSA design or enable any back doors in our 
> products. Decisions about the features and functionality of RSA products
> are our own." The NSA declined to comment.
> The RSA deal shows one way the NSA carried out what Snowden's documents
> describe as a key strategy for enhancing surveillance: the systematic 
> erosion of security tools. NSA documents released in recent months 
> called for using "commercial relationships" to advance that goal, but 
> did not name any security companies as collaborators.
> The NSA came under attack this week in a landmark report from a White 
> House panel appointed to review U.S. surveillance policy. The panel 
> noted that "encryption is an essential basis for trust on the Internet,"
> and called for a halt to any NSA efforts to undermine it. Most of the
> dozen current and former RSA employees interviewed said  that the company
> erred in agreeing to such a contract, and many cited  RSA's corporate
> evolution away from pure cryptography products as one of the reasons it
> occurred. But several said that RSA also was misled by government
> officials, who portrayed the formula as a secure technological advance.
> "They did not show their true hand," one person briefed on the deal  said
> of the NSA, asserting that government officials did not let on that they
> knew how to break the encryption. STORIED HISTORY
>  View gallery    
> A National Security Agency (NSA) data gathering facility is seen in
> Bluffdale, about 25 miles (40 km … Started by MIT professors in the
> 1970s and led for years by ex-Marine Jim Bidzos, RSA and its  core
> algorithm were both named for the last initials of the three  founders,
> who revolutionized cryptography. Little known to the public,  RSA's
> encryption tools have been licensed by most large technology  companies,
> which in turn use them to protect computers used by hundreds  of millions
> of people.
> At 
> the core of RSA's products was a technology known as public key 
> cryptography. Instead of using the same key for encoding and then 
> decoding a message, there are two keys related to each other 
> mathematically. The first, publicly available key is used to encode a 
> message for someone, who then uses a second, private key to reveal it.
> From RSA's earliest days, the U.S. intelligence establishment worried 
> it would not be able to crack well-engineered public key cryptography. 
> Martin Hellman, a former Stanford researcher who led the team that first
> invented the technique, said NSA experts tried to talk him and others 
> into believing that the keys did not have to be as large as they  planned.
> The stakes rose 
> when more technology companies adopted RSA's methods and Internet use 
> began to soar. The Clinton administration embraced the Clipper Chip, 
> envisioned as a mandatory component in phones and computers to enable 
> officials to overcome encryption with a warrant.
> RSA led a fierce public campaign against the effort, distributing 
> posters with a foundering sailing ship and the words "Sink Clipper!"
> A key argument against the chip was that overseas buyers would shun 
> U.S. technology products if they were ready-made for spying. Some 
> companies say that is just what has happened in the wake of the Snowden 
> disclosures.
> The White House abandoned the Clipper Chip and instead relied on export
> controls to  prevent the best cryptography from crossing U.S. borders.
> RSA once again rallied the industry, and it set up an Australian division
> that could  ship what it wanted.
> "We became the tip of the spear, so to speak, in this fight against
> government efforts," Bidzos recalled in an oral history. RSA EVOLVES
> RSA and others claimed victory when export restrictions relaxed.
> But the NSA was determined to read what it wanted, and the quest gained
> urgency after the September 11, 2001 attacks. RSA, meanwhile, was
> changing. Bidzos stepped down as CEO in 1999 to  concentrate on VeriSign,
> a security certificate company that had been  spun out of RSA. The elite
> lab Bidzos had founded in Silicon Valley  moved east to Massachusetts,
> and many top engineers left the company,  several former employees said.
> And the BSafe toolkit was becoming a much smaller part of the company. By
> 2005, BSafe and other tools for  developers brought in just $27.5 million
> of RSA's revenue, less than 9%  of the $310 million total.
> "When I joined there were 10 people in the labs, and we were fighting the
> NSA," said Victor Chan, who rose to  lead engineering and the Australian
> operation before he left in 2005.  "It became a very different company
> later on."
> By the first half 
> of 2006, RSA was among the many technology companies seeing the U.S. 
> government as a partner against overseas hackers.
> New RSA Chief Executive Art Coviello and his team still wanted to be 
> seen as part of the technological vanguard, former employees say, and 
> the NSA had just the right pitch. Coviello declined an interview 
> request.
> An algorithm called Dual Elliptic Curve, developed inside the agency, was
> on the road to  approval by the National Institutes of Standards and
> Technology as one  of four acceptable methods for generating random
> numbers. NIST's  blessing is required for many products sold to the
> government and often  sets a broader de facto standard.
> RSA adopted the algorithm even before NIST approved it. The NSA then 
> cited the early use of Dual Elliptic Curve inside the government to 
> argue successfully for NIST approval, according to an official familiar 
> with the proceedings.
> RSA's 
> contract made Dual Elliptic Curve the default option for producing 
> random numbers in the RSA toolkit. No alarms were raised, former 
> employees said, because the deal was handled by business leaders rather 
> than pure technologists.
> "The labs group had played a very intricate role at BSafe, and they were
> basically gone," said labs veteran Michael Wenocur, who left in 1999.
> Within a year, major questions were raised about Dual Elliptic Curve. 
> Cryptography authority Bruce Schneier wrote that the weaknesses in the 
> formula "can only be described as a back door."
> After reports of the back door in September, RSA urged its customers to
> stop using the Dual Elliptic Curve number generator. But unlike the
> Clipper Chip fight two decades ago, the company is  saying little in
> public, and it declined to discuss how the NSA  entanglements have
> affected its relationships with customers.
> The White House, meanwhile, says it will consider this week's panel 
> recommendation that any efforts to subvert cryptography be abandoned.
> (Reporting by Joseph Menn; Editing by Jonathan Weber and Grant McCool) 






From eric at konklone.com  Sun Dec 22 20:33:06 2013
From: eric at konklone.com (Eric Mill)
Date: Sun, 22 Dec 2013 23:33:06 -0500
Subject: FYI
In-Reply-To: <E1VunTS-0002q0-IH@elasmtp-junco.atl.sa.earthlink.net>
References: <CAGM6gCerJ1Jpmzm_T212TvVxg50_mCi6o5uRn1Tgw0zctLUKNQ@mail.gmail.com>
 <20131222034511.9050E680095@frontend2.nyi.mail.srv.osa>
 <CAJVRA1QgXyyaG1hshq+CFfNcJFKF1U28vjucjDgWZCmD=NT=UA@mail.gmail.com>
 <E1Vuj8C-0001CJ-2B@elasmtp-junco.atl.sa.earthlink.net>
 <CADhsnxfKGJ5w2wOu_-0GpPiWMnTKHcQDten55_76UhVDD0R+iQ@mail.gmail.com>
 <E1VunTS-0002q0-IH@elasmtp-junco.atl.sa.earthlink.net>
Message-ID: <CANBOYLW_EFRq4NmQg+BUcfFsX9HAmrKiT-H+Y49-D+hH3XSfTA@mail.gmail.com>

Have you considered managing your own servers, or buying some and having
them colocated?


On Sun, Dec 22, 2013 at 1:11 PM, John Young <jya at pipeline.com> wrote:

>
> At 12:39 PM 12/22/2013, you wrote:
>
>> i was accessing this site for months, based on
>> frontpage cryptome recommendation. is it spoofed?
>>
>> https://secure.netsolhost.com/cryptome.org/index.html
>>
>
>
> No, it's legit. We don't promote it to avoid entrapping
> believers in https. Go there are your peril same as the
> quicksand quagmire.
>
> Just to confess, we don't have control of our ISP servers,
> thus warn of what is happening behind impossible security
> promises from us to others. Warning seldom heeded so
> powerful is the PR for online protection fantasies.
>
> Few people have control of what their sites are used for.
> Thus the cosmetic policy privacies which conceal
> abuse bruises. Not as bad as 24x7x365 top security staff
> outfoxed by Snowdens, similars and betters not doing
> what Ed did, or is said to do, or misunderstood to do,
> or is doing now under the noses of the explainers,
> investigators, spoofers, black marketers, the usual
> stabbers, slashees, hackes, punks, investors and angels.
>
> This is not limited to Windows, applies to all software
> and hardware and networks and whatchagot there
> air-gapped, padlocked, SCIFed, totally secure, as
> the Snowden hoarders brag, believing wierdly that
> what Snowden did will never happen to them, or has
> already happened, or happened on 0-day.
>
>
>
>
>
>


-- 
konklone.com | @konklone <https://twitter.com/konklone>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2361 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131222/43ace5b1/attachment.txt>

From juan.g71 at gmail.com  Sun Dec 22 19:25:08 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Mon, 23 Dec 2013 00:25:08 -0300
Subject: request for transcript: Bruce Schneier and Eben Moglen discuss
 a post-Snowden Internet
Message-ID: <46BE817573FD8AD50AC94BE3@F74D39FA044AA309EAEA14B9>



	more schneier's transcriptions 
	
	"there are legitimate secrets in there that you actually don't want
released - there are - there really are"  

	"a wikileaks style data dump would not be fun for anybody - so that's good"


	So, this is the guy who says that tor works. Lol. 



	


	
	




From jelledetaeye at gmail.com  Mon Dec 23 09:08:21 2013
From: jelledetaeye at gmail.com (Jelle De Taeye)
Date: Mon, 23 Dec 2013 11:08:21 -0600
Subject: Acoustic Cryptanalysis: Extracting RSA Key From GnuPG by capturing
 Computer Sound
Message-ID: <CAARYVEKP-pkgwkYiWv2VX1k+LDwxR9b6W7pLbxbV+wpBAYQSHA@mail.gmail.com>

Thought this could be interesting:
http://thehackernews.com/2013/12/acoustic-cryptanalysis-extracting-rsa.html

Paper:
http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 734 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131223/538d22b9/attachment.txt>

From jya at pipeline.com  Mon Dec 23 12:11:01 2013
From: jya at pipeline.com (John Young)
Date: Mon, 23 Dec 2013 15:11:01 -0500
Subject: Alan Turing Pardoned by Queen Elizabeth II
Message-ID: <E1VvBoz-0001A8-1X@elasmtp-dupuy.atl.sa.earthlink.net>

<http://cryptome.org/2013/12/turing-pardon.pdf>http://cryptome.org/2013/12/turing-pardon.pdf  
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 137 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131223/8c5ab56c/attachment.txt>

From joseph.g.tag at gmail.com  Mon Dec 23 12:53:00 2013
From: joseph.g.tag at gmail.com (Joseph Tag)
Date: Mon, 23 Dec 2013 15:53:00 -0500
Subject: stu-iii type4 included; Key Gen Servers; TEMPEST; CMW.....
Message-ID: <CAEy+Hk_0qBkhd6FFQm3eJg-4BiG-j7MAWOLrrshavZ0-Xfs98g@mail.gmail.com>

I am reminded that Gretag AG ( Swiss ) now Gretacode/Omnisec made type 4
STU-3 ; partner of U.S. company Datotek ( Farmers Branch / Realty Rd;
Dallas TX ) :  modified the CSD-4100 phone. Now see
http://www.tccsecure.comWest Concord MA USA. TCC and Datotek were arch
rivals and Datotek buckled.
Datotek founded by ex Texas Instruments folks.  Also be aware of Motorola
Sectel 9600.   It is wild how Govt influences others!

IBM , DEC-Digital Equipment Corp, HP, Data General, SUN ( now Oracle ) ,
Wang Labs all made TEMPEST terminals and other equipment.

Best wishes to all. End.




-- 
Sent from Gmail Mobile
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 690 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131223/8f5cb87c/attachment.txt>

From grarpamp at gmail.com  Mon Dec 23 15:35:42 2013
From: grarpamp at gmail.com (grarpamp)
Date: Mon, 23 Dec 2013 18:35:42 -0500
Subject: [Cryptography] HSBC's Password Approach: Impressive
In-Reply-To: <52B86C32.3070600@borg.org>
References: <52B86C32.3070600@borg.org>
Message-ID: <CAD2Ti28iXJZJDKbcuUKJxjs6eGLFPUZ4fS+GToWSgg53U+h0zA@mail.gmail.com>

> They are being pretty clever to make up for terribly endpoint security.

Yeah, all that might work for non brick and mortar stuff you maybe care about,
say email [1], and your fave pornsite. But really... you need to be able to
demand a hardware OTP token from your bank and brokerage... plenty of
cheap open hw exists for that, not RSA, ahem. Any B&M's that don't offer hw
are just using 'clever' obfuscation or cost reduction around the issue of real
security. But since they already cost reduced that nice 4-7% interest they
used to pay you, don't expect this anytime soon. Unless they figure with
real security they could then twist responsibility for that account wiping
transaction to uganda... on you.

[1] Outlook.com uses that stupid 'no cut/paste' thing, worthless and
annoying as fuck for those of us who use real password safes with
real random unmemorizable passwords.




From grarpamp at gmail.com  Mon Dec 23 22:33:13 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 01:33:13 -0500
Subject: [p2p-hackers] [Cryptography] Size of the PGP userbase?
In-Reply-To: <52B8BE3C.70903@broadley.org>
References: <CAMm+LwgfU4m5uGtwX2c8vJfow4DArY7-qmG7-Zm=c+3dQgVEqg@mail.gmail.com>
 <CAGHP0pLgLAYiwH0W+tPWAjOHyDhm2a4akbQecCggi39tq8K1Xg@mail.gmail.com>
 <CAMm+LwhuCy7fgSck8puAQkC7EjZM2ipJKYXoTuCD=+_Rys3Y8Q@mail.gmail.com>
 <496AE1B3-FB03-4C7D-B904-D3D7C8C62E09@callas.org>
 <CAMm+LwhXe2pxzhxW9QwMxgbrP+REfZbGyvfE2jVHKDQ-JoupaA@mail.gmail.com>
 <CAD2Ti2-N4+faRKhyAXY4cDyJcROQFizFvgnX2u=mprBEHiZzrg@mail.gmail.com>
 <52AEA612.3060308@jondos.de>
 <CAD2Ti284LP3-0i4ycqkMVo3H8U6rEvrFNeOEtz=CYpOPGSDx+w@mail.gmail.com>
 <52B8BE3C.70903@broadley.org>
Message-ID: <CAD2Ti28v8Tr13VJq7CfpccrDpaq6PnwDhXkcFz1hEKji2i4CzQ@mail.gmail.com>

Send things to the list, not me.

On Mon, Dec 23, 2013 at 5:50 PM, Bill Broadley <bill at broadley.org> wrote:
> On 12/16/2013 12:01 AM, grarpamp wrote:
>>> You may have a look of "I2P Bote" it is severless, encrypted mail
>>> system, address is the public key, P2P based... nice tool.
>>
>> As in another post of mine, I'll be looking at that again.
>> My first take was that it stores the messages in the DHT,
>> which didn't seem scalable or reliable at all. I may be
>> wrong as I read more later.
>
> I feel like I walking in halfway into a conversation, I'm guessing this
> started on the cryptography list that I'm not on.
>
> Your DHT comment caught my attention though.  What in particular about
> DHTs don't seem scalable or reliable?
>
> Seems like DHTs are regularly in the 5-10M range and I don't see any
> reason that DHTs couldn't be 10 times that.
>
> Any reasonable churn rate and reliability could be handled with
> replication.  The bit-torrent DHT for instance claims that 45% of users
> that bootstrap from a central node are reachable 15 minutes later.  So
> typical setups involve 8 nodes per bin, and 20 bins.  So every 15
> minutes you ping 160 hosts, only reach 45%, and do some work to
> repopulate the missing slots.
>
> Given the simplicity of the bit-torrent DHT I think there's plenty of
> room for improvement.  Larger routing tables are obvious (at the cost of
> more network bandwidth to track peers).
>
> The most promising idea for DHT improvements I've seen is to divide
> peers into 3 latency groups.  High, medium, and low.   Much like L1
> cache, L2 cache, and main memory.  That way common queries are very
> fast, yet all queries still to find keys globally.




From grarpamp at gmail.com  Tue Dec 24 01:20:51 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 04:20:51 -0500
Subject: The next gen P2P secure email solution
Message-ID: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>

This thread pertains specifically to the use of P2P/DHT models
to replace traditional email as we know it today. There was
a former similarly named thread on this that diverged... from the
concept and challenge of P2P/DHT handling the transport and
lookups... back to more traditional models. This thread does not
care about those antique models, please do not take it there.

In short, we're attempting to examine and develop some form
of new transport that looks somewhat like a mix between secure
anonymous networks, string at pubkey node addressing, massive
decentralized dht-like scaling and finally a user facing daemon that
moves messages into and out of local spools for use by normal
user/system tools.

Pasting in a very rough and unflowing thread summary to date
for interested people to pick up and discuss, draft, etc.

=====
grarpamp...
> [pgp/smime email encryption, etc]
> What is the gap we have to close to turn this on by default?

How many times has this been rehashed the last six months?
You can't fix email as we know it today using todays bolt-ons,
protocols and corporate stakeholders/services trying to profit from it.
The only way to have any real global seamless success is to go
ground up with a completely new model. IMO, that will be some
form of p2p message system where every address is a crypto key,
masked for grandma by her contact list, decrypted out your p2p
daemon and piped into your local mail processing (MUA/filter/lists)
and filesystem (encryption). At least that way your local mail tools
will still work (no one will give those up anyway).

The problem is the antique centralized backend, it needs bypassed.
You've got neat stuff like Tor, bittorrent, bitcoin, etc already... so
boost email into the 2020's the same way. Then let the old world
email services try to keep up, and slowly die like everything else.
=====
grarpamp...
On Mon, Nov 25, 2013 at 1:01 AM, ianG <iang at iang.org> wrote:
> On 23/11/13 15:30 PM, Ralf Senderek wrote:
>> On Sat, 23 Nov 2013, David Mercer wrote:
>>
>>> But of course you're right about actual current usage, encrypted email
>>> is an
>>> epic fail on that measure regardless of format/protocol.
>>
>> Yes, but it's about time we do something about that. Do we *exactly know
>> why* it is such a failure?
>
> It's an interesting question, and one worth studying for pedagogical
> motives.  From my experiences from both sides, it is clear that both sides
> failed.  But for different reasons.
> Hence, I've concluded that email is unsecurable.

Obviously. It will never be able to escape the non-body
header content and third party routing, storage and analysis with
any form of patching over today's mail. And it's completely
ridiculous that people continue to invest [aka: waste] effort in
'securing' it. The best you'll ever get clients down to is exposing
a single 'To:' header within an antique transport model that
forces you to authenticate to it in order to despam, bill, censor
and control you.

That system is cooked, done and properly fucked. Abandon it.
What the world needs now is a real peer to peer messaging
system that scales. Take Tor for a partial example... so long
as all the sender/recipient nodes [onions] are up, any message
you send will get through, encrypted, in real time. If a recipient
is not up, you queue it locally till they are... no third party ever
needed, and you get lossless delivery and confirmation for free.
Unmemorable node address?, quit crying and make use of your
local address book. Doesn't have plugins for current clients?,
so what, write some and use it if you're dumb enough to mix
the old and new mail.

The only real problem that still needs solved is scalability...
what p2p node lookup systems are out there that will handle
a messaging world's population worth of nodes [billions] and
their keys and tertiary data? If you can do that, you should
be able to get some anon transport over the p2p for free.

Anyway, p2p messaging and anonymous transports have
all been dreamed up by others before. But now is the
time to actually abandon traditional email and just do it.
If you build it, they will come.
=====
fabio...
I'm strongly against most the ideas to abbandon current email systems,
because the results will be to create wallet garden.

We need something interoperable with existing systems or the system will
just be used by a bunch of paranoid people or fostered by the marketing
of few cryptography company acquiring customers, not user.
=====
grarpamp...
It would be interoperable with current end user interfaces/tools, but not
directly with you at some.dotcom.
As with everything else, today's seeds grow into tomorrows garden, sometimes
you just have to thorougly plow under last year's chaff first, that's by design.
=====
viktor...
E-mail is basically business correspondence.

    - E-mail is stored.
    - E-mail is sent to many people outside your personal social network.
    - Business recipients of email are often subject to corporate and/or
      regulatory policy constraints that are in conflict with end-to-end
      encryption.

The above list of features can be greatly expanded, and the
consequences elaborated, but I doubt may on this list truly need
to be re-educated about email.

So I will confidently predict that end-to-end secure email will
remain a niche service used by a tiny minority.
...

Even businesses that one might expect to implement at least encryption
to the "gateway", are in many cases choosing to out-source their
gateway to 3rd-party providers (anti-spam and anti-virus offerings
only work with un-encrypted email, and in many cases the provider
also operates the entire mail store).
....
[and others also said: tls, dane, skype, smime, ca's, smtp, etc]
=====
Jerry...
Medical, Financial
=====
grarpamp...
Nothing here changes, only the backend transport between nodes.
Once your node decrypts the message to your local system pipes,
you can do all this and more with it. Including running a 'business' node
and doing whatever you want with the plaintext after your node daemon
passes it to you. This is not about those ancient protocols. It's also
about 'messaging' not strictly 'email'... those lines are already well
blurred, no need to distinguish between them anymore. A 'light'
messaging client could simply ignore the non transport email headers,
or use your standard msg at nodekey address.
Please do not continue to talk about antique tradional centralized
systems in this thread, except of course to bash and route around them.
The speed of a real P2P/DHT replacement at scale is a research challenge.
=====
coderman...
this would make an interesting bet!  i too believe this to be
impossible given the constraints.
=====
grarpamp...
I'm not so sure about this, look at all the global resources being poured
into traditional email, and attempts to 'fix' it. Now redirect fractional 1%
of those resources and put them into a P2P replacement. That's ftw.
=====
natanael...
Say hello to Bote mail on I2P.

I2P provides encrypted anonymizing networking, Bote mail provides DHT
based serverless encrypted mailing with public crypto keys as
addresses (ECDSA or NTRU).

http://i2p2.de and i2pbote.i2p (if you don't have I2P installed, add
.us to visit it via an inproxy).

There is also I2P Messenger that is encrypted P2P IM within I2P also
using public keys as addresses.
=====
cane...
You may have a look of "I2P Bote" it is severless, encrypted mail
system, address is the public key, P2P based... nice tool.

  https://en.wikipedia.org/wiki/I2P#E-mail
=====
grarpamp...
> You may have a look of "I2P Bote" it is severless, encrypted mail
> system, address is the public key, P2P based... nice tool.

As in another post of mine, I'll be looking at that again.
My first take was that it stores the messages in the DHT,
which didn't seem scalable or reliable at all. I may be
wrong as I read more later.

> Afterwards you can add the "I2P Bote plugin", the serverless mail
> system. SMTP- and POP3 support was on the ToDo list some times ago, I

I think that's working now. And is the general idea, create a strong
overlay network with a frontend MUA's can speak to.

As an aside: If you can make that overlay net present an IPv6 tunnel
interface on the local host, that lets you use any IPv6 enabled
app over it. I'm doubting the world needs a dozen application
specific overlay networks. More like just a few classes of network.
- message based store and forward
- low latency IPv6 transport
- data storage and retrieval
=====
natanael...
Bote mail doesn't have to be used for it's anonymous properties, for
me that is just a bonus. For many people it is more than enough to be
able to know that it is impossible for anybody else than the intended
recipient to read the message thanks to public key addressing.
Guaranteed end-to-end security if you can verify the address.
I don't think anything that doesn't fundamentally rely on public key
addressing is the (long term) future. There will inevitably issues
otherwise, including more issues of the type we have with CA:s today.
For those who want to make it more user friendly, nothing stops you
from adding a transparent "address translation layer" where servers
are involved. When you want to send a message to a person with a human
readable address at a server, then the server could then reply with
the public key based address to the mail client, and the user would
have the option to see what that address is. It could even be logged
by the client, with TOFU/POP style trust system that reduces the
amount of trust you have to place in the server. No need to trust
anybody with plaintext.
=====
grarpamp...
I suggest such interfacing with the current legacy system will only prolong
it's long past due extinction. Build a better system and let them come to you,
not the other way around. And bolting in exits will only make it harder to
do correctly and optimally what you need to do as a P2P system. Please,
just forget about interfacing with the legacy transport system. If you really
need that you can run your own p2p daemon node that acts as your
automated gateway between the two. This is mostly about design of
the p2p side, not that.
=====
james...
It is my understanding of the proposed replacement for email.  Magic
email addresses that in fact correspond to an identifier of a public
key, for example the hash of a rule that identifies the public key,
and which result in your message not in fact being passed along by
email protocols.
=====
grarpamp...
If you're not going to send directly to the very long account at nodepubkey, then
yes, you'll need to create another layer on top to hold your h(key). However,
the key must still be obtainable behind that since that is what the messages
will ultimately be encrypted and routed to. It's not much of a stretch beyond
that to ensure userland mail tools can handle say 8k long addresses. I'm not
against such a [vanity/shorthash] layer.
=====
natanael...
Bote mail and I2P messenger are two pieces of serverless software that
ALREADY is public key addressed within I2P. Have you tried them? You
need to add the public keys of the recipients to be able to send a
message to start with, although the DHT based search system Seedless
allow you to publish Bote mail addresses to the network.

(IMAP support for Bote mail is planned but not yet implemented, right
now it has a local web interface.)

Maybe Namecoin could work together with them to enable you to register
your key addresses to your nickname in a secure manner, but then you
still have to have a globally unique nickname and tell people the
exact spelling.
=====
> ralf...
> If you are so sure, can you tell us how the next generation secure email
> solution will solve the "trust problem", please.

grarpamp...
Though unclear, that sounds like the old trust of a CA/PKI system problem.

> How does the p2p daemon
> find the correct crypto key, so that every user can rely on its invisible
> performance?

In general I suggest that people wish to use messaging with each other
once they already know them (or have some other trusted web to them).
As in, Hey John, nice to meet ya today, what's your key (address), I'll
message you later. Or Hey Jane, what's John's address. Same for
employers, businesses, etc. Such peer groups bootstrap and grow
very fast. Thus the perceived need for a cold lookup of Ralf, isn't much of
a real one.
Once you know the address (node crypto key), you put it 'To: <key>',
mua hands to spool, p2p daemon reads spool, looks up key in DHT and
sends msg off across the transport to the far key (node) when it is
reachable. Hopefully the transport looks like I2P/Tor in being a secure
random hop layer. In fact, those could probably be used today, they
have the keys as nodes and user facing ports for inbound/outbound
daemons. They just need scaling work to n-billion nodes (users,
aka: the hard part). People are already plugging postfix, bittorrent,
etc into these networks.

Tor is not currently addressible at the user level by the full key,
it 'shortens' the key into a 16char onion address. As you may be
hinting at... yes, that is bad... collisions, and needing secondary lookup
layers into the full key. Tor may be moving to full key addressibility
soon, see tor-dev for that.

I2P (and Phantom, and probably GnuNet) are addressible with full keys.
So you can send to 'account at key' with them if you want, and keep the
John/Jane/Ralf human style lookups in your MUA addressbook (once
you know them) without needing a secondary lookup layer into the full key.

No, I am not sure. But when looking at some of the p2p transport
layers that have come along so far, it seems like a fairly strong
possibility for a new backend transport model while retaining user
level mail tools... mutt, maildrop, mailman, Thunderbird, etc. Most
of what you'd need there is support for very long addresses and
split horizon handoff to local daemon/spool based on recognizing
what the destination net is... .onion, .i2p, etc.
I'd like to read what Pond and I2P-Bote are doing with some parts of
this as well.

I don't believe you need a trusted CA/PKI service to successfully
bootstrap users and their addresses/keys into a new global messaging
system. If I want to know what some unknown like Bruce's key is, I'll
look it up on his website, social net, list posts, etc. If that's what you
mean.
=====
bill...
I feel like I walking in halfway into a conversation, I'm guessing this
started on the cryptography list that I'm not on.

Your DHT comment caught my attention though.  What in particular about
DHTs don't seem scalable or reliable?

Seems like DHTs are regularly in the 5-10M range and I don't see any
reason that DHTs couldn't be 10 times that.

Any reasonable churn rate and reliability could be handled with
replication.  The bit-torrent DHT for instance claims that 45% of users
that bootstrap from a central node are reachable 15 minutes later.  So
typical setups involve 8 nodes per bin, and 20 bins.  So every 15
minutes you ping 160 hosts, only reach 45%, and do some work to
repopulate the missing slots.

Given the simplicity of the bit-torrent DHT I think there's plenty of
room for improvement.  Larger routing tables are obvious (at the cost of
more network bandwidth to track peers).

The most promising idea for DHT improvements I've seen is to divide
peers into 3 latency groups.  High, medium, and low.   Much like L1
cache, L2 cache, and main memory.  That way common queries are very
fast, yet all queries still to find keys globally.
=====
grarpamp...
Bittorrent is already in the 100m node range. That's not enough. This
needs to replace every possible messaging user on the planet over
the duration of their actiive lifetime. That's at least a couple billion nodes.
Don't forget, you can always use disk to cache things.
=====
> james...
> Need a system for handing one's keys around that protects end users from
> the horrifying sight of actual keys or actual strong hashes of keys.

john...
But at the same time the system has to not say, "I can't deliver your
message to that person because an invisible gnotzaframmit that I won't
describe to you seems to be unavailable to me in the flabogrommit."

grarpamp...
Address books as usual. Name layer if need be. We are humans, we
learn new lexicons, we write manuals, that part is nothing to be afraid of.
Being afraid only holds you back.
=====
> grarpamp...
> I don't believe you need a trusted CA/PKI service to successfully
> bootstrap users and their addresses/keys into a new global messaging
> system. If I want to know what some unknown like Bruce's key is, I'll
> look it up on his website, social net, list posts, etc. If that's what you
> mean.

> guido...
> You can use an untrusted CA to bootstrap. I show how it can be done at:
>
> http://eccentric-authentication.org/Brucon-Eccentric.pdf

ralf...
This is an interesting idea, because it provides certificates on
demand for ordinary users, if they decide to sign up to a certain
site. The
certs are then being used for other purposes, so the site does act as a
bootstap for using crypto. The one thing that this proposal relies on is
the availability of a common piece of software (user agent) that stores
the private key for the user. It's this part of the picture where things
get tricky.

grarpamp...
There can be no non-distributed/redundant elements in this p2p system,
aka: no 'sites', certainly none with a realworld IP on them, and none where
very high percentages of them vanishing will disrupt the system for others.
This must replace email, therefore system disruption is intolerable.
=====




From grarpamp at gmail.com  Tue Dec 24 02:13:04 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 05:13:04 -0500
Subject: The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
Message-ID: <CAD2Ti28MB1iCuejf6yOyote1NKbiehPJq9momua6Q0PZWjq5YQ@mail.gmail.com>

More summary pasting...

/ Someone...
/ There are people I know who do not mind the extra steps for pgp. I
/ certainly want to get the roll out to use and test and enjoy. Sign me
/ up.

grarpamp...
Encryption is only part of it. There's transport, elimination of
central storage, anonymity, p2p, etc. Many things people want
simply can't be done with modifications to the current system.
With p2p model and every node as a key/address, you don't
need 'pgp' because the node is the key and does lookups and
encrypt2dest / decrypt2you for you. But you can still use pgp with
the usual tools around message bodies if desired for additional
encrypt/auth or if you're disk isn't encrypted. P2P daemon
takes over and all the old transport headers go away.
Spam/AV becomes another local daemon. Mailing lists are
a repeater node someone runs, or the usual local mailman stuff.
It's a transport replacement, so business can use it account at node.
All the MTA's [connected directly to the internet] die off in time.




From grarpamp at gmail.com  Tue Dec 24 02:45:17 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 05:45:17 -0500
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <20131224100911.GB20486@jack>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <20131224100911.GB20486@jack>
Message-ID: <CAD2Ti2-KxvLW9J_LHXOTSeJNWf7J33RNYcDDPcsmfMCJjwkZ9A@mail.gmail.com>

On Tue, Dec 24, 2013 at 5:09 AM, danimoth <danimoth at cryptolab.net> wrote:
> A problem which could rise is the 'incentive' for peers to continuosly
> providing bandwidth and disk space to store messages. I'm a simple dude,
> with a mailflow of ~5 email per day. Why I should work for you, with
> your ~10000 mail per day for all your mailing list?

I think this is one of many design choices to be made.

Extra bandwidth is hard to avoid, unless the topology is
point(sender)-to-point(recipient). Yet with that, there is no effort made
to hide who is physically talking to who. We want to try to defeat this
type of analysis, so we can't be simply point-to-point.
 ie: bittorrent and today's email are point-to-point, no multihop.

Next is storage (mix) vs. latency (tunnels). This seems less clear to
me when up against analysis. Filling circuits (tunnels) with chaff
seems interesting. And with deliverey directly to your recipient over
some tunnel circuit, you don't have to build in complex message redundancy
protocols (more storage float outstanding) to ensure your message 100%
gets there when 90% of the nodes go offline taking your stored message
with them. You also get direct realtime delivery confirmation too.

> Somewhere on this list (or p2p-hackers?) there was a post of mine,
> regardings an economic incentive between peers, which could be a
> solution, but as always technical problems arose, like pricing the
> services and a fair exchange between peers.

The question arises, how does one provide free anonymous transport
to those anons who simply can't pay because they are anon? How
do you 'get users' when the mentality is 'for free'? Bittorrent/Tor are
free and seem to work ok. Though it's also probably not unreasonable
to suggest (and harder to enforce) that you get 1:1 what resources you
donate to it. ie: I need to push 1GiB this month, so I need to provision at
minimum 1+Nx1GiB to do that... 1 for me, Nx1 for the net due to my use
(where N is some impact ratio inherent in the design of the net, such
as number hops.)




From grarpamp at gmail.com  Tue Dec 24 02:52:49 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 05:52:49 -0500
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAAt2M1-1DUxHwCz-O21rYgCMi0MkUYka9wGw3qOaUVoSQQkJvw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <CAAt2M1-1DUxHwCz-O21rYgCMi0MkUYka9wGw3qOaUVoSQQkJvw@mail.gmail.com>
Message-ID: <CAD2Ti2_s=tEWF8nNr8pA+xq=gAb2b=cwXyc6GT47PJOCKZBNrg@mail.gmail.com>

On Tue, Dec 24, 2013 at 5:03 AM, Natanael <natanael.l at gmail.com> wrote:
> Somebody in there mentioned allowing IPv6 addressing on top of I2P/Tor. That
> would be Garlicat/Onioncat. It creates a local virtual IPv6 network
> interface for your software to use, so that you can map key based addresses
> to routable local addresses.
>
> https://www.onioncat.org/about-onioncat/

It is worth noting that Phantom does this natively without needing an overlay on
top of another net. It may also use disk to cache some network information, at
least their whitepaper says they are 'for' making that choice. Perhaps it can be
scaled? https://code.google.com/p/phantom




From grarpamp at gmail.com  Tue Dec 24 03:21:09 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 06:21:09 -0500
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <20131224100135.GA20486@jack>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <20131224100135.GA20486@jack>
Message-ID: <CAD2Ti2-M87x+fQvcm-=JPv=_DrgOY-9q2R=_nx6czo3xNUGPGg@mail.gmail.com>

On Tue, Dec 24, 2013 at 5:01 AM, danimoth <danimoth at cryptolab.net> wrote:
> In these months there was a lot of talking about "metadata", which SMTP
> exposes regardless of encryption or authentication. In the design of
> this p2p system, should metadata's problem kept in consideration or not?
> IMHO exposing danimoth at cryptolab or my <key> it's the same, as there is
> a function between them. I2P and/or Tor adds complexity to avoid such
> mapping to any non-state-level adversary.

I'd assume the design will rightly provide complete end2end encryption between
your source spool and your recipients spool over whatever bits are in between,
as a result of having the key, equivalent to the node, equivalent to
the address.
Store and forward might need to expose only the destination key to the storage
and routing net. A direct circuit would not.

All the legacy 'received' headers are gone by definition. A full raw message
might contain some required bits for continued use with your favorite mail tools
post handoff to you:

>From - As with today, this may or may not end up being authenticateable by the
recipient. Since the net itself would seem to need to be anonymous, then it is
likely not. Nor is it a problem if it is... you just generate yourself
a new node if concerned.
To, Cc, Bcc
Date
Subject
Message-ID
[Threading]
Body

Antispam/antivirus becomes responsibility of the sender/recipient so no
headers there. No legacy dkim, spf, etc, either.

There may be a new set of transport preference headers if the design calls
for it. ie: You might be able to use the net with full mail clients
like mutt, thunderbird.
Or with a light 'messaging' client protocol. Each of which might have
a slightly different
interface into and out of the node.

Addresses might look like:
[user/function or protocol/arbitrary string]@[node pubkey/hash]

I've no idea, only to see if interested people think some sort of nextgen
P2P/DHT system is actually possible at scale.




From danimoth at cryptolab.net  Tue Dec 24 02:01:35 2013
From: danimoth at cryptolab.net (danimoth)
Date: Tue, 24 Dec 2013 11:01:35 +0100
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
Message-ID: <20131224100135.GA20486@jack>

On 24/12/13 at 04:20am, grarpamp wrote:
> Once you know the address (node crypto key), you put it 'To: <key>',
> mua hands to spool, p2p daemon reads spool, looks up key in DHT and
> sends msg off across the transport to the far key (node) when it is
> reachable.

In these months there was a lot of talking about "metadata", which SMTP
exposes regardless of encryption or authentication. In the design of
this p2p system, should metadata's problem kept in consideration or not?
IMHO exposing danimoth at cryptolab or my <key> it's the same, as there is
a function between them. I2P and/or Tor adds complexity to avoid such
mapping to any non-state-level adversary.




From danimoth at cryptolab.net  Tue Dec 24 02:09:11 2013
From: danimoth at cryptolab.net (danimoth)
Date: Tue, 24 Dec 2013 11:09:11 +0100
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
Message-ID: <20131224100911.GB20486@jack>

On 24/12/13 at 04:20am, grarpamp wrote:
> This thread pertains specifically to the use of P2P/DHT models
> to replace traditional email as we know it today. There was
> a former similarly named thread on this that diverged... from the
> concept and challenge of P2P/DHT handling the transport and
> lookups... back to more traditional models. This thread does not
> care about those antique models, please do not take it there.

A problem which could rise is the 'incentive' for peers to continuosly
providing bandwidth and disk space to store messages. I'm a simple dude,
with a mailflow of ~5 email per day. Why I should work for you, with
your ~10000 mail per day for all your mailing list?

Somewhere on this list (or p2p-hackers?) there was a post of mine,
regardings an economic incentive between peers, which could be a
solution, but as always technical problems arose, like pricing the
services and a fair exchange between peers.




From grarpamp at gmail.com  Tue Dec 24 13:01:08 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 16:01:08 -0500
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <20131224141951.GA32084@loar>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
Message-ID: <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>

>>> https://lists.torproject.org/pipermail/tor-talk/2013-November/031001.html

>> https://bayimg.com/BAfJGAafB

> Sorry, but no.
> Tor mailing lists are not places where spreading rape culture is ok,
> whatever the point you are trying to make.

Perhaps it is a leaked artistic caricature of a fun/educational play
session between consenting parties in something like edukink,
sfcitadel, soj, tes, fetlife and the like. Perhaps it is something else.
As with all art... interpretation, learning, and appreciation or lack
thereof is upon the viewer. No need to click links or start wars over
them if you don't like.

https://en.wikipedia.org/wiki/Freedom_of_speech_versus_blasphemy
https://en.wikipedia.org/wiki/Freedom_of_speech
https://en.wikipedia.org/wiki/Art
https://en.wikipedia.org/wiki/Journalism
https://en.wikipedia.org/wiki/Sex
https://en.wikipedia.org/wiki/Unix
https://en.wikipedia.org/wiki/Humor

> Roger's original request was for a mashup he could use in his
> presentations to LEAs and to the NSA itself.
> Somehow I don't see him using this. :-)

Surely some NSA listening post is getting a really good
laugh after ingesting that link. Here's more that would
make equally good follow ons to their previously leaked
slides when mashed together in a future presentation...
https://www.google.com/search?tbm=isch&q=nsa+parody
https://www.google.com/search?tbm=isch&q=nsa+humor

/ Agreed.  It's offensive and frankly lazy.
/ http://i.imgur.com/PV2q1ZO.gif

Oh really? Here we thought 'fuck'ing was offensive.

_ I like the double entendre: FreeBSD > Linux :)
_ Accurate and funny. Nice work.

Someone should add a Fawkes mask in the shoetip for
added effect.

Now that everyone's well represented, no further comment.




From hozer at hozed.org  Tue Dec 24 14:13:16 2013
From: hozer at hozed.org (Troy Benjegerdes)
Date: Tue, 24 Dec 2013 16:13:16 -0600
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
Message-ID: <20131224221316.GF3180@nl.grid.coop>

On Tue, Dec 24, 2013 at 04:01:08PM -0500, grarpamp wrote:
> >>> https://lists.torproject.org/pipermail/tor-talk/2013-November/031001.html
> 
> >> https://bayimg.com/BAfJGAafB
> 
> > Sorry, but no.
> > Tor mailing lists are not places where spreading rape culture is ok,
> > whatever the point you are trying to make.
> 
> Perhaps it is a leaked artistic caricature of a fun/educational play
> session between consenting parties in something like edukink,
> sfcitadel, soj, tes, fetlife and the like. Perhaps it is something else.
> As with all art... interpretation, learning, and appreciation or lack
> thereof is upon the viewer. No need to click links or start wars over
> them if you don't like.

Seriously?

If I had a security clearance and my job was to identify idiots to watch
more closesly, I'd make that image, post it anonymously, over tor, then
see who has an emotional reaction and starts posting a lot of links about
freedom of whatever.

That being said, it's funny in a third-grade sort of humor way, but what
I'd rather see is John Stewart/The Onion/cracked.com intelligent satire.

We can do better than bending over for the NSA and saying 'have at it'

So do better.




From grarpamp at gmail.com  Tue Dec 24 17:29:52 2013
From: grarpamp at gmail.com (grarpamp)
Date: Tue, 24 Dec 2013 20:29:52 -0500
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <20131224221316.GF3180@nl.grid.coop>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
 <20131224221316.GF3180@nl.grid.coop>
Message-ID: <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>

> Seriously?
> freedom of whatever.

Tor is, in part, about freedom. And freedom is seriously
serious business, not some 'whatever'. Seriously.

> what I'd rather see is John Stewart/The Onion/cracked.com
> intelligent satire.

So create some, and post it, anonymously or not. You have that
freedom. Whether a thousand word illustrated essay or boiled
down to a single image, there's no real difference.

http://www.cracked.com/video_18725_if-16-pregnant-was-around-nativity-story.html
http://www.cracked.com/blog/undeniable-proof-that-european-christmas-terrifying/
http://www.cracked.com/blog/7-reasons-tsa-sucks-a-security-experts-perspective/

The 'intelligent satire' above could be offensive to some. Maybe
these boiled down intelligent satirists are offensive to people too...
https://www.youtube.com/results?search_query=george+carlin
https://www.youtube.com/results?search_query=richard+pryor

But you know, let's just decry and ban it all.

> We can do better than bending over for the NSA and saying 'have at it'

You're right... as torizens, cypherpunks, and whatever else,
bending over for the NSA is definitely not in our interests ;-)
Kinda why people are working to get better at doing it right, baby.




From 42 at enigmabox.net  Tue Dec 24 11:34:38 2013
From: 42 at enigmabox.net (42)
Date: Tue, 24 Dec 2013 20:34:38 +0100
Subject: The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
Message-ID: <20131224203438.ff7974e9eaaefad2b66491c2@enigmabox.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 24 Dec 2013 04:20:51 -0500
grarpamp <grarpamp at gmail.com> wrote:

> This thread pertains specifically to the use of P2P/DHT models
> to replace traditional email as we know it today. There was
> a former similarly named thread on this that diverged... from the
> concept and challenge of P2P/DHT handling the transport and
> lookups... back to more traditional models. This thread does not
> care about those antique models, please do not take it there.
> 
> In short, we're attempting to examine and develop some form
> of new transport that looks somewhat like a mix between secure
> anonymous networks, string at pubkey node addressing, massive
> decentralized dht-like scaling and finally a user facing daemon that
> moves messages into and out of local spools for use by normal
> user/system tools.

That is exactly what we have implemented already:
http://enigmabox.net/en/encrypted-emails/

And it works pretty well. We rely on cjdns for everything network
related (transport, end-to-end encryption, address allocation).


- -- 
42 <42 at enigmabox.net>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJSueHPAAoJELqmW1wGWUSYqVkP/jDH0pm9hLRO+zwCRrzmKGjT
Q+j6/YXiNwvxv6KJsE4xZOF3f2uuA1496/jDhhSwE042daM7wU1Lt5AH6s0KlQJB
f2lE1q7xutvH9MxNlntpJOvMG5ROGID554CGF6hDjs8lvto1HDkvm+D4qx/lWSAR
Q1AEwiCWpcpP3aFKxCqGw3/X91UYvSDhpewzGiBcJljNmbzEWa4YmlB4bUavR3qL
INVB7NIj/XdbwWOW1OSU5NF1FQoLqz9W5rJ3VP3Nkl8dK4rPp5tcvp+ZNXJ6awSD
jVr1WIKncmIbJwVrItKPMb+Y16STF0mMO/DOFH3Zsj5Po8F/QsXsr54de1WkHCkY
82DVAsxl9dkrLekugVShDsWIfNoS4w4P3hOCshBV+9bWplIZ8vLQfdQX3RRxL2L0
BwEIWqkGBfPShq8rZiswA79jVVcmWaCRZ37EtfNJKndjgRx+/yzJWGsLF253UiQn
jOs0m7+Qmj3i0joNWnsr17hldLW+P6bJwPyHaJL/MMlHgSuJgfZoOvOjmBoH5VZO
y+P4QHPlu7w2ehipbCcdnNlKZXL/pMKBF8o89l4b0cRVaLOcxBvfJWs5BEqEhhdr
flGdhQbgNS/H5t6hqd93M6J4y3Gj+YZ1mRv9LgOpSvQaCQnq3PM4NHNDGr7XCipL
+RvlfRziqmpmRApgVt+d
=3CQb
-----END PGP SIGNATURE-----




From rdohm321 at gmail.com  Wed Dec 25 04:19:18 2013
From: rdohm321 at gmail.com (Randolph)
Date: Wed, 25 Dec 2013 13:19:18 +0100
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
Message-ID: <CAEvNM8koxGTcvuUVfHdXZ3ewGei0ni3DC1pvqfz2tGX5diSx0Q@mail.gmail.com>

Anyone looked at BitMail p2p ?
http://sourceforge.net/projects/bitmail/?source=directory
2013/12/24 grarpamp <grarpamp at gmail.com>

> This thread pertains specifically to the use of P2P/DHT models
> to replace traditional email as we know it today.
> Pasting in a very rough and unflowing thread summary to date
> for interested people to pick up and discuss, draft, etc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 911 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131225/1d31ac7e/attachment.txt>

From hozer at hozed.org  Wed Dec 25 11:32:15 2013
From: hozer at hozed.org (Troy Benjegerdes)
Date: Wed, 25 Dec 2013 13:32:15 -0600
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
 <20131224221316.GF3180@nl.grid.coop>
 <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>
Message-ID: <20131225193215.GG3180@nl.grid.coop>

> https://www.youtube.com/results?search_query=richard+pryor
> 
> But you know, let's just decry and ban it all.

Go ahead and post it. I'm not stopping you. I am, however, excercising
my freedom of speech to try to point out that the image you appear to
be defending may be a psy-ops campaign from those who get paid to keep 
secrets.
 
> > We can do better than bending over for the NSA and saying 'have at it'
> 
> You're right... as torizens, cypherpunks, and whatever else,
> bending over for the NSA is definitely not in our interests ;-)
> Kinda why people are working to get better at doing it right, baby.

My point is that by promoting that image and the culture(s) it represents
you may be bending over and broadcasting "Here I am, here's how to control
me" to nation-states and email providers that make money based on how many
advertising links you click.




From grarpamp at gmail.com  Wed Dec 25 11:23:10 2013
From: grarpamp at gmail.com (grarpamp)
Date: Wed, 25 Dec 2013 14:23:10 -0500
Subject: The next gen P2P secure email solution
Message-ID: <CAD2Ti28e6csTUTCeoqXn_OkpaO4dJinXakLgnhgRPf-7HNByJQ@mail.gmail.com>

On Wed, Dec 25, 2013 at 8:21 AM, Jeremie Miller
<jeremie.miller at gmail.com> wrote:
> This thread seems pretty immense and in various places, what's the best way to contribute to it?
>
> I'm pretty keen on the topic, been working on /real/ p2p infrastructure for 5+ years now :)


I'm not sure that it has a proper home. I do not suggest metzdowd,
which is where I think you picked it up. cypherpunks has the most
thread content to date. Though p2p-hackers is perhaps best for now
unless anyone else has a better idea? ie: another p2p centric list
with a good bit of anonymity and crypto representation.
p2p-hackers is having delivery issues at the moment so maybe
continue to cc cypherpunks for another week till that is sorted out.




From iam at kjro.se  Wed Dec 25 11:58:30 2013
From: iam at kjro.se (Kelly John Rose)
Date: Wed, 25 Dec 2013 14:58:30 -0500
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <20131225193215.GG3180@nl.grid.coop>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
 <20131224221316.GF3180@nl.grid.coop>
 <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>
 <20131225193215.GG3180@nl.grid.coop>
Message-ID: <CAFd=HCebvEW6KvgHigdFQtPANc5WyOzS_0WW3r=F4wi8ixLryw@mail.gmail.com>

Wow, is this seriously political correctness self censorship encouragement
in the name of security culture based anti psyops?

And I thought I'd heard it all.

On Wednesday, December 25, 2013, Troy Benjegerdes wrote:

> > https://www.youtube.com/results?search_query=richard+pryor
> >
> > But you know, let's just decry and ban it all.
>
> Go ahead and post it. I'm not stopping you. I am, however, excercising
> my freedom of speech to try to point out that the image you appear to
> be defending may be a psy-ops campaign from those who get paid to keep
> secrets.
>
> > > We can do better than bending over for the NSA and saying 'have at it'
> >
> > You're right... as torizens, cypherpunks, and whatever else,
> > bending over for the NSA is definitely not in our interests ;-)
> > Kinda why people are working to get better at doing it right, baby.
>
> My point is that by promoting that image and the culture(s) it represents
> you may be bending over and broadcasting "Here I am, here's how to control
> me" to nation-states and email providers that make money based on how many
> advertising links you click.
>


-- 
Kelly John Rose
Toronto, ON
Phone: +1 647 638-4104
Twitter: @kjrose
Skype: kjrose.pr
Gtalk: iam at kjro.se
MSN: msn at kjro.se

Document contents are confidential between original recipients and sender.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1937 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131225/5fa4dcd2/attachment.txt>

From grarpamp at gmail.com  Wed Dec 25 12:06:32 2013
From: grarpamp at gmail.com (grarpamp)
Date: Wed, 25 Dec 2013 15:06:32 -0500
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAEvNM8koxGTcvuUVfHdXZ3ewGei0ni3DC1pvqfz2tGX5diSx0Q@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <CAEvNM8koxGTcvuUVfHdXZ3ewGei0ni3DC1pvqfz2tGX5diSx0Q@mail.gmail.com>
Message-ID: <CAD2Ti28L_+F8p0VhR4XCkSGwqvrh0C2L=3cTa0boa_MwTjtSmg@mail.gmail.com>

On Wed, Dec 25, 2013 at 7:19 AM, Randolph <rdohm321 at gmail.com> wrote:
> Anyone looked at BitMail p2p ?
> http://sourceforge.net/projects/bitmail/?source=directory

re: bitmail, goldbug, etc.

With all due respect, I doubt few here have or will anytime soon.
You spam out links to binaries no one's heard of, your source probably
isn't deterministic to your binaries, bsd/linux support?, your development
model doesn't appear open, code is hosted on a site few care about anymore,
you've no papers, presentations, mailing list or community involvement,
you've advertised the good name of other projects as being affiliated with
your work without their permission. And you've failed to address any of
this publicly despite people kindly prompting you to do so. In these
communities, that's a big red flag.
As always, full benefit of the doubt is given. If you need hosting for code,
lists, website... some code review, testing, etc... just ask an appropriate
list. We need more cool ideas and software... but you really need to step
up to the plate in these areas if you want people to take you seriously.




From electromagnetize at gmail.com  Wed Dec 25 13:29:59 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Wed, 25 Dec 2013 15:29:59 -0600
Subject: blackflag operations
Message-ID: <CADhsnxdiEeJLz8ZkYKzjLPNBYjuoE4RCnfL-c_8pfhk8o_prWg@mail.gmail.com>

// proposed relevant to cypherpunks considerations...

at a certain point in my independent research it was
realized that the US flag itself represented the existing
problem encountered with ideology and rule-following
that automatically functions against core principles,
such that 'the stars' were of false constellations and
'the stripes' were more those of prison bars, to hold
the population captive inside a hierarchical top-down
structure, which i equate with a conceptualization in
Networks of Power, of system, order, and control [1]
as it determines economic, social, political dynamics.

thus the US flag, its symbolism, is part of the problem
in terms of its rigid adherence, especially in a realm of
patriotism and xenophobia, such that it appears to deign
reasonable the US as world empire without questioning
its own failures or correcting for them, only extending it
further outward, which then serves policies the hidden
US dictatorship perfectly, as long as silence is upheld
and no communication is possible about these issues.

(that is, in terms of reasoning of empirical truth as this
would be observed by the law as the basis for power,
versus making the constitution a relativistic document
interpreted via power determining what the signs mean)

in this way, so too the powerplant and grid of development
that underlines present-day civilization, a centralized and
hidden realm of top-down power and control governed by
private interests said to function on behalf of the public,
yet with little evidence of this within ruins of the planet.

in other words: power delivery is related to governance.
and how power flows in one-direction and 'represents'
certain goals and ideals that do not map into the local
issues or shared values beyond a certain framework or
mindset that makes monetary profit is greatest truth.

and yet truth does not work this way. which is to say,
it is not invalidated by ignoring or censoring it out of
existence within these domains, it still exists though
is isolated, disconnected, and thus loses its power
via a false-worldview that takes its place via lies and
deception, a shared illusion that is ungrounded yet
sustained in a bubble, antihuman in word and deed.

in terms of consciousness, much of this is known
and experienced day to day, life to life, yet remains
uncommunicable due to the loss of language, the
absence of connection in realistic terms, about this
inhuman condition, the center of civilization becoming
that of nothingness, of lost souls at the core of it, this
essential vacancy of meaning, devaluing of knowledge
beyond what interests and benefits those in authority,
and thus a seemingly irrational situation exists and is
mediated, one by one, that does not add up nor does
it make any sense, part to whole, because all is left
is fragmented and misaligned, dumbed down, warped
and skewed such that a hall of fun-house mirrors is
the limit to daily reflection in status quo relations, as
nothing more can be said than some finite limit where
the basic situation cannot even be acknowledged, so
hostile is the background and near-field effects, that
any error or wrong thought could jeopardize survival
and force a person into exile or worse, via all-seeing
accountants for conformity, verifying and making sure
the brain washing is effective, all remain followers of
the ideological framework, staying within its confines

and so knowing is disconnected for saying or even
thinking, people detached from themselves and others
and then to awake and find oneself situated in this way;
essentially without being, without access to their own
true nature or capacity or abilities, instead neutered
by what is now convention, via subversion, deception


electromagnetism as the context for the US flag then
recontextualizes some questions of vexillology [2], in
that evaluating the symbolic structure of the flag in its
relation to electrical infrastructure as a system of power
that extends beyond electricity into issues of politics of
the state, including waging of war for natural resources,
and likewise systems based on this ordering, visualized
in urban and rural artifacts of transmission pylons and
distribution poles, then provides further context for the
issues of control - including 'surveillance' in this same
top-down structure, which serves the hierarchy firstly,
to retain its existing historical organization, however
hollowed out and corrupted, used as a false-flag op


in thinking through issues of endless war in the
Middle East and the nonsensical War of Error as it
relates to failure of ideas to govern state actions and
instead submission to faith in leadership and hidden
policies and political agendas, antihuman in ideology
and nature, due to their inaccuracy, loss of capacity
in thinking and language that then functions against
citizens and life, instead of on behalf of these -- this
situation then becoming 'source code' and program
based on flawed and wrong-minded processing of
actions, using, relying upon, exploiting loopholes
in the US constitution as basis for what is possible,
this becoming morality and ethics and its own truth,
the danger of action being untethered from grounded
reasoning and instead FAITH-BASED in ideology of
rightness, with no remaining checks and balances
after the orchestrated power grab, post-coup (41)
in which the state is opposed to truth that does not
serve and submit to this hidden agenda as highest

what have you then, as a citizen in this situation,
do you benefit or are your days numbered as you
wait, channeled into the correct chutes for awaiting
cattle cars, death panels and Obamacare first steps


enough is enough, sanity must regain its place, and
reason based in grounded truth must be secured for
anything other than this automatic decline to continue
into a realm of pure hate and unrestrained evil, driven
by the state in its godless construction and operation


in this way, US Blackflag operations were called for
to regain control over the state and its actions via
an emergency measure built into the constitution that
allows a constitutional convention to be called if or when
the state goes off course due to legal guidelines once written
yet which function against the very principles they stand for

and thus, to raise the Blackflag as the symbol and sign of
this human citizen, to reclaim control over the shared state
and its governance, and remove the existing US flag from its
role as oppressor of its own and other populations, in that
the truth of the US Constitution has become decoupled from
its accounting in logic, beyond that of shared opinion within
language (sign=sign based pattern matching), such that the
views 'believed' are ideological, based and reliant upon ever
shifting relativism that maps to motives of power & authority
over this process of interpretation, as institutionalized, this
the very structure of society, politics, economics, yet within
a bubble view that cannot be falsified, contested, debated
even (see: closed, onesided mass media), and this as the
authority, the 'mind' at the top of the machinery, that sees
and observes everything in this warped, unreal self-serving
viewpoint, that what is good for it is the best for everybody,
any number of rationalizations reinforcing this viewpoint,
and yet no error correction anywhere allowed, especially
in a legal context, because truth itself has been outlawed

thus the ability to critique or correct the malfunctioning of
the state is an impossibility, given the loss of reasoning
that no longer relies upon empirical truth for verification
and validation of processes, and instead 'shared belief'
and a 'superior knowing' takes this place, without anchor
to truth outside a binary simplism, yet beyond correction
for its errors, because they can be ignored, denied, and
the other side destroyed, as is necessitated ideologically;
one side must lose for the other side to win, these "rules"


blackflag would counter this coup and takeover of the state
by a hostile invading population by regaining legal control
over its decision-making and accounting for events in terms
of accountable truth, not allowing secrecy and privilege to
stand-in for assurances of 'good intentions' underneath it all,
at the same time those opposed to institutionalized criminality
are being weeded out of civilization one by one, via surveillance
and attacks against basic existence and subsistence, those
of the traitorous state having been empowered by the takeover
to go the next step, the purging of dissenters and dissidents,
of any who threaten their agenda, privatizing the public realm
and denying services to those not of their shared demographic

in this way, so too, US taxes serving this group primarily as
others go without or are attacked by these same services,
health care becoming administering of disease and death,
social services to increase helplessness and incapacitation,
maximizing profits while engineering conditions impossible
to survive, thus crushing the life out of those at the bottom
and making each year more difficult than the last, death as
if a gift, it cannot arrive early enough, genocide as if mercy


my first attempt at conveying these ideas was to recolor the
US flag as all black while retaining its stars and stripes as
the structure[3]. the problem with this was that it revealed
the ideological formatting of the state, in its rigid lines and
ordering that are the manifestation of this corruption of the
historic compact between individuals & larger organization,
and how governance at the top requires imprisoning those
below, as part of the warped structural dynamics relied upon
and thus injustice built-into the system, its foundation, this
notably in 'mankind' as the shared identity, this privatized
viewpoint scaled to the public allowing any individual to act
in pure selfishness without regard or responsibility to others-
this enshrined in law, outdated as viewpoint, 'the public' does
not exist in this state beyond an 18 century notion, and this
is exactly how this corruption is allowed operate today, by
not acknowledging this condition and correcting it in law-
which requires logic, 3-value and N-value logic, to prove
the binarist viewpoint wrong though also immoral, illegal,
unethical, and yet this very 'reasoning' is forbidden today.


i began to sew, having a black nylon technical fabric,
the goal being to generate a more accurate structure for
the flag that would reflect or in some way represent the
actual dynamics of truth within society, these ideals and
principles of the US constitution in a shared human context,
where both men and women are equal as citizens, and that
people operate in different conditions yet function together
as part of a larger dynamic, an ecosystem that becomes
the state via a decentralized and distributed organization,
scaling from local to national if global contexts, conditions,
situations, aligned via shared dimensions, truth as value

the flag that resulted [4] has a slightly different symbology.
there are many stars, points of light, though some of these
become larger stars via their connected patterning (that is,
points connect or scale up into larger star structures, and
some may be separated at any moment & other combined)

the goal was to demonstrate that constellations of people
or ideas can form, amongst points of individuals, organize
into patterned structures that form a basis for shared order,
and while in the photograph of the flag it is not visible, there
are various regions or boundaries for these relations/events,
where some of these points and stars exist within the same
limits and others exist beyond or outside a given threshold.

(there were additional close-up photos though i do not have
most any of my work archived, though the language of the
zigzag stitching defined these various regional boundaries,
that then translates into near or far within larger ecosystem)

add to this then the linking or networking of these 'stars',
that for me are based on the butterfly paper clamp and also
on the star as a high-voltage transmission pylon or tower, in
this way, structural interconnections can be conceptualized
as -p-o-w-e-r-l-i-n-e-s- and also as the invisible lines that link
together constellations invisibility mapping out the night sky
as stars and structures relate, and capture or model meaning,
to include helping with navigation, awareness, and worldview

in this sense pattern recognition is structural, foundational,
and connections and relations between people in shared truth
is this larger empirical awareness, emerging from relativistic
scenarios, as truth is aligned amongst people and related to
and through, in changing dynamics, shared state as circuitry
and information processor, logical reasoning and organization,
this _ground-up leveling of awareness, ideas, intent, action,
virtue, truth, justice, development, higher purpose, ideals

in this way, so too, power delivery, locally to regionally and
how it scales based upon its shared relation with truth and
those who serve it, as this contrasts with the US flag and
its institutionalization where such dynamics are disallowed,
and people are silenced in these relations, truth vanquished,
something else taking hold, terrorizing citizens in its place


this call for the blackflag to rise and replace the corrupt
US government by legal means, regaining control of the
failed state via constitutional right, then is a challenge to
the reigning falsity that rules and politically 'governs', using
its power against citizens to secure its power indefinitely,
relying on illegal means and methods beyond accountability
due to secrecy and privacy that only applies to oppressors,
while such protections are removed for enemies and used
to exploit and force the downfall of those who live here

the language then may become shared, that yes, such
high insanity must be acknowledged and thus the charade
can be further extended to allow continuing control as these
subversive others continue to attempt to control the reins of
state action, at any cost. and thus mimicry could exist that
seeks to 'represent' this cause via a traditional mindset that
is corrupted by ideology and "believes" something other than
what is said, serves some unacknowledged agenda or view,
that is only camouflaged by the flag, and thus is assumed
to retain control, whatever the shifting dynamics by relying
on the same structures to persist, whatever the new color

in this way, the blackflag yet another false flag for these
traitors who would exist alongside those involved, grounded
within this structural awareness of truth, its transparent and
logical accounting beyond skewed binary onesidedness. a
realm of imposters, mimics, cheats and frauds thus would
continue and yet to juxtapose, compare and contrast these
dynamics, it should be clear that 'the rationale' is entirely
different for these two flags [5], they are not the same idea,
and do not sustain the same beliefs, principles, or ordering

they are actually set against one another in this very moment,
as changes begin to be wrought and pressures exist that still
constrain such actions, based upon resistance, power and
authority based on forbidding what is best for human citizenry

the ideological grid of the present is a cage, a prison camp
purpose-built for human holocaust whereby truth is denied
and eventually outlawed, nonexistence as the present day,
people trapped and existing inside an illusion, not living, only
trying to sustain themselves, keep breathing in the cemetery

in this condition, this separation into many, the individual parts
begin communicating, realize connections in grounded truth
that establish this empirical framework needed, and it involves
taking down the walls built by the state, its prison bar stripes
and false-stars and false-constellations based on emulation,
the state as hollywood movie production, leaders as actors
playing a role on the world stage, versus addressing issues
that exist and being held accountable for such 'representation'
driven by taxation that grows this machinery while seeking to
extinguish citizens inside who do not obey or are the enemy
of those with power. that is what can be seen within various
signs and symbols, language, calculus, patterns & geometry


the difference between these flags is the difference between
ideas and ideology, shared truth versus shared falsity and lies,
freedom versus imprisonment, responsibility versus greed and
unfettered selfishness, duty in opposition to vanity and frivolity,
the network versus the grid, being vs. nothingness, humanity
versus antihumans, individuals vs. institutions, democracy of
human citizens versus corporate democracy, empirical reality
versus relativistic madness, and philosophy versus psychiatry

the existing US flag is the embodiment of politics that replace
the truth with its antithesis which becomes a basis for power,
the blackflag is all about governance, between people who
create and compose the larger state via empirical reasoning
that is based in truth, accounted for and error corrected by
logic, and held accountable and required to change, improve
its functioning, not given the right to ignore its obligations to
people, life, nature, and the larger order it is situated within

the delivery of power will one day arrive, deliverance from this
corrupted condition, within a organized coherent agenda that
regains control over this automated machinery serving wrong
principles and wrong ideas and wrong thinking and beliefs.

there are two orders, represented by these flags. one of
them is aligned with falsity and serves it for its own benefit.
the other serves truth, firstly and wholeheartedly. it is about
how the constitution of a person aligns with those around them
and how this scales and relates and is represented by the state.

the false have their flag. recoloring it is not going to change
anything structural, which is required for the oppression and
exploitation to continue. it can only and must be destroyed as
an institutionalized structure to regain control over the failed state,
as the US constitution outlines and allows. the nature of truth is
conceptualized in the other flag, its blackness has depth and
grounding in principles that reflect those of its people and those
who sacrifice and serve, for greater truth and higher principles
than the base and monetary as if the meaning of life eternal

in other words, no longer will the body govern over the mind,
no longer will the grid determine the network, nor ideology
the truth of ideas. and indeed there is a binary condition
that exists in this situation- between truth and pseudo-truth,
where actual truth grounds to 1 and pseudo-truth to falsity (0).
in this way there is only one value, it is truth. all or nothing.

the US state needs to be brought under constitutional control,
destroy the existing dictatorship, and draft a new constitution

i for one stand against the ongoing criminality of the state
and vote the military take control of its functioning to secure
its actions from those hostile to human citizens and our future


[1] Networks of Power - Thomas P. Hughes
http://en.wikipedia.org/wiki/Thomas_P._Hughes

[2] Vexillology
http://en.wikipedia.org/wiki/Vexillology

[3] black US flag
https://www.dropbox.com/s/wyazpebuo9ilzjd/usflag_black.jpg

[4] blackflag
https://www.dropbox.com/s/m66fp09796k4h6x/blackflag.jpg

[5] dual black flags
https://www.dropbox.com/s/s3vw6pbrmbl8v2q/dual_blackflag.jpg

Alexander Calder 1974 stabile Black Flag
http://vintagehudsonvalley.files.wordpress.com/2011/03/stormking-031811.jpg?w=639&h=272




From electromagnetize at gmail.com  Wed Dec 25 17:51:33 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Wed, 25 Dec 2013 19:51:33 -0600
Subject: conceptual theatre
Message-ID: <CADhsnxfHN9X_Sr9Yq9PUFdp4je2buKotxbVo1RHOztkB2g1g6g@mail.gmail.com>

in times like these you might expect there would be
music about what is going on, films investigating the
concepts (many quite good actually), other activities,
painters painting (a few) and so on, to establish depth
to conversation and communication instead of enforcing
ideological limits and functioning in limited parameters,
reinforcing traditional feedback loops corruption relies upon

especially plays, literature. perhaps some of the latter in
its detachment or documentary aspects or parallels yet
where is the cultural insight of those most free on earth-
why the silence when searching for 'play on surveillance'
that would have theater delving into realm of importance
and providing critique, frameworks to evaluate ongoing
situations within, instead of- well, seemingly nothing.

- of - the - most - free - people - in - the - entire - world -

with nothing to say or views to share about this situation,
not using their rights or freedoms -- adding up to nothing

fucking disgraceful. shameful, self-indulgent, self serving
hypocrisy. as if bureaucracy must sign off on everything.
no allowable risk. disneyification of the entirety of culture,
endless reruns of previous ideas and interpretations yet
no one with enough insight to frame this given picture?

or is it fear that holds people back, silence is safety

no one willing to take a stab at it, and then another
to regain a space and place lost to complacency and
lack of will, responsibility, greater purpose than money

certainly playwrights of the past would have engaged,
though what about direct engagement, for understanding

to model the situation and evaluate it as only theater
can do, to create other atmospheres that capture these
situations and make what is ineffable due to abstractness
tangible, realized, understood, and relatable through use
of actors and storytelling and stage and props, scenery


my contribution to this, as a structural idea for plays
about surveillance society, free for use as a concept:


that a stage with one person, at other times two people
(or more) could exist as if on a basketball court, whereby
bleachers would exist on either side of the main area

1) this could involve a central stage with two bleacher wings,
splayed out facing an audience as if vanishing perspective

2) else it could be an actual school gymnasium with large
bleachers where a theatric performance takes place

see: concept for stage design and structure for play
https://www.dropbox.com/s/pic7z1x1sqdj8az/concept.gif


here is the idea. people in the bleachers are surveillers,
they may either sit on the sidelines, and then aspects of
the play could move in parallel in these other dimensions
(geospatial, store tracking, license scanning, credit card
history, database mining and advertising, listening to calls
and keyword mapping, metadata, tracking receipts, etc)

in version 1 (above) they would then be functioning the
_background, otherwise invisible to the people in the center
of their daily lives, behind this hidden threshold of rules, laws,
language that forbids understanding of this condition at the
same time it defines the existence and actions of the people

warping or skew of data, the hypocrisy of tracking details by
companies or reselling of data, public-private profit strategies,
extortion, blackmail, political abuse, marketing, web adverts,
social network mapping, any of this commentary introduced
into this position of the actors at center stage as they relate
with others, such as using the phone or a computer, as this
links to people or topics, 'feedback' as various events occur

in version 2 (above) the same dynamics could occur though
with plants in the audience, sitting amongst others in the
bleachers, perhaps people wearing all black suits, dark
glasses, holding strange equipment, and instructions for
those in the bleachers to relay messages (the telephone
game) where a signal is passed along regular routes and
thus input is transformed by output, then passing this data
back into the play, as improvisation. for instance, a "secret"
could be passed into the bleachers by an informant, and
then by a defined route, 10 or 15 people in a given line or
sequence (marked by graphics) could be part of this flow
of data, having to relay what they heard one to the next,
to get the data to the black suited mystery people, and
thus the message they receive is then output as signal
back into the play, to those center stage or others who
are inacting with it, such that 'traveling to sign-ville' then
becomes 'unraveling the dollar bill' when later output, etc


thus, this kind of conceptual format would allow creative
expression and exploration of issues, perhaps it would
be best and most informed by technical consultation
with privacy or security and-or other experts, including
data from those surveilled, such that a larger sense of
what this involves could be sketched for citizens so that
its impact and importance could be gauged in a context
of daily living, to what extent this data gathering and this
tracking and watching is going on, and what principles it
is currently be driven by and how laws do not exist that
can constrain its functioning against citizens day to day,
and that everyday situations involve these dimensions
and issues of privacy, security, and such exploitations


playwrights have the unique skills to convey such
cultural messages and raise consciousness, and do it
in a memorable and intriguing and innovative way. where
is the equivalent of the Snowden of playwrights, perhaps
such a format could be reinterpreted by a dozen or more
playwrights, from varying angels or degrees or settings.
what if the structure is modular, and can add, subtract,
or modify the ideas of other plays using this structure,
and thus open or free source the play for interpretative
exploration and development. it is the information and
the perspective that is important, the truth of what is
going on. theaters are places for living ideas, not the
continual regurgitation of those dead and lifeless as if
highest value or truth. there is missing data of today,
who is willing to approach to present and convey what
it involves, using all the resources available to transmit
important information and ideas, start and sustain the
conversation beyond its existing, stifling boundaries

freedom does not exist if it is not made use of. and
it goes away if seeking permission to do something,
because somewhere along the line it may involve risk.
but isn't it worth trying to do something and seeing what
the real situation is, and then knowing from that, then to
not even try, not even do anything, and supposed to know
by not taking it on, accepting defeat without ever fighting

there have got to be some playwrights willing to take
on these issues. if they exist, hopefully so, it would be
interesting to see what such plays involve in their content
and approaches to conveying and conceptualizing issues
of cyberspace, hacking, surveillance, attacks, and so on

929-2010   780-2888   810-4356
-------------- next part --------------
A non-text attachment was scrubbed...
Name: parti.gif
Type: image/gif
Size: 66684 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131225/2f95aa25/attachment.gif>

From electromagnetize at gmail.com  Wed Dec 25 19:33:36 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Wed, 25 Dec 2013 21:33:36 -0600
Subject: conceptual theatre (addenda)
Message-ID: <CADhsnxfs8W6b9ih=54JMvG2DECdEm-ypgw06vFNVkgrX0W9y6w@mail.gmail.com>

another approach to conveying ideas about surveillance
through theater is via commentary on HDTV split-screen...


   +-------------------+--------------------+
   |     critique      |     television     |
   |                   |        show        |
   |     o   0 o       |                    |
   |   0 | 0 | |  ==>  |     0       o      |
   |   | | | |o|  ==>  |    /|\ <--> /\     |
   |  o|  o|  |   ==>  |     \       ||     |
   |  | 0 | O |   ==>  |     /\      ||     |
   |  | | | |          |                    |
   +-------------------+--------------------+


the aspect ratio could use or shrink a 4:3 aspect ratio for a given show or
new content, and then alongside it, to the left have a call center or
fundraising booth approach, in league with MSTK3 [3302032.9200] style
commentary occurring simultaneously with commentary as satire or otherwise,
given original or new content. for instance, an episode for existing or
preexisting television comedy could be thus be recontextualized and
reinterpreted via this approach, where the surveillance society would have
attackers stealing pins via hidden
card readers when an actor uses a cash-machine or purchases something at a
cash register. likewise, make a phone call and the surveillers light up
with commentary about what is going on, adding depth and counterpoint and
absurdity into the illusion of the 'secure' context, presented as if normal
and everyday. in this way, a theater approach could exist via such
conceptual structure and provide a format to explore such ideas via
advanced viewpoints and perspectives otherwise lacking or absent in their
parallelism, as situations coexist in simultaneous, interacting hidden
dimensions

these dynamics and relations then, thresholds, boundaries, identity and
awareness, as it relates to what is and is not observed, near and far, and
how it is all put together or people remain oblivious to the context of
their own existence via lack of information or legal protection from
events, and shared and-or unshared quasi-'reality' - perhaps a form of
wilderness, a condition of rogue ideology waiting for ideas capable of
evaluating it

[3302032.9200] Mystery Science Theater 3000
http://en.wikipedia.org/wiki/Mystery_Science_Theater_3000

hing (hen   ated wid   ional sta
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3122 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131225/fd65439b/attachment.txt>

From jamesd at echeque.com  Wed Dec 25 13:41:07 2013
From: jamesd at echeque.com (James A. Donald)
Date: Thu, 26 Dec 2013 07:41:07 +1000
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <CAFd=HCebvEW6KvgHigdFQtPANc5WyOzS_0WW3r=F4wi8ixLryw@mail.gmail.com>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
 <20131224221316.GF3180@nl.grid.coop>
 <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>
 <20131225193215.GG3180@nl.grid.coop>
 <CAFd=HCebvEW6KvgHigdFQtPANc5WyOzS_0WW3r=F4wi8ixLryw@mail.gmail.com>
Message-ID: <52BB50F3.5040009@echeque.com>

On 2013-12-26 05:58, Kelly John Rose wrote:
> Wow, is this seriously political correctness self censorship
> encouragement in the name of security culture based anti psyops?

"rape culture" a move by some people to censor other people -

"Your thoughts get women raped. This make my thoughts holier than your 
thoughts, and me holier than you"

Everyone is encouraging false rape accusations.  No one is encouraging rape.

Accusations of "rape culture", are frequently made, and always false.

Accusations of encouraging false rape accusations are never made, and 
should be.




From gwen at cypherpunks.to  Thu Dec 26 09:12:34 2013
From: gwen at cypherpunks.to (gwen hastings)
Date: Thu, 26 Dec 2013 09:12:34 -0800
Subject: Boycott the RSA Conference - List of Honor
Message-ID: <52BC6382.3060307@cypherpunks.to>

Well Kids,

    the RSA Conference is coming to the Bay area yet again,

So far F-secure is worthy of Honor they have chosen to boycott the
conference, as EVERY HONEST security and crypto firm/personnel should
 do.. the next few months will tell both us and the public who we can
start to put on the naughty or nice lists..

Bravo to F-Secure and  Mikko Hypponen, the beginning of Honest security
consulting firms..

 his reason quoted below

“I don’t really expect your multibillion dollar company or your
multimillion dollar conference to suffer as a result of your deals with
the NSA. In fact, I'm not expecting other conference speakers to cancel.
Most of your speakers are american anyway – why would they care about
surveillance that’s not targeted at them but at non-americans.
Surveillance operations from the US intelligence agencies are targeted
at foreigners. However I’m a foreigner. And I’m withdrawing my support
from your event.”
http://www.theregister.co.uk/2013/12/24/fsecure_wont_speak_at_imperialist_lackey_rsas_conference/


And Trevor Pott Journalist from the Register is also boycotting..
http://www.theregister.co.uk/2013/06/08/what_about_a_us_tech_boycott/


Let the honor roll grow!!

-- 
Governments are instituted among men,
 deriving their just powers from the consent of the governed,
that whenever any form of government becomes destructive
of these ends, it is the right of the people to alter or
 abolish it, and to institute new government, laying its
 foundation on such principles, and organizing its powers
 in such form, as to them shall seem most likely to effect
 their safety and happiness.’




From matej.kovacic at owca.info  Thu Dec 26 07:05:01 2013
From: matej.kovacic at owca.info (Matej Kovacic)
Date: Thu, 26 Dec 2013 16:05:01 +0100
Subject: P2P VPN
Message-ID: <52BC459D.9060007@owca.info>

Hi,

this might be of interest to you:
https://code.google.com/p/badvpn/

Peer-to-peer VPN

The VPN part of this project implements a Layer 2 (Ethernet) network
between the peers (VPN nodes). The peers connect to a central server
which acts as a chat server for them to establish direct connections
between each other (data connections). These connections are used for
transferring network data (Ethernet frames), and can be secured with a
multitude of mechanisms. Notable features are:

    * UDP and TCP transport
    * Converges very quickly after a new peer joins
    * IGMP snooping to deliver multicasts efficiently (e.g. for IPTV)
    * Double SSL: if SSL is enabled, not only do peers connect to the
server with SSL, but they use an additional layer of SSL when exchanging
messages through the server
    * Features related to the NAT problem:
         1. Can work with multiple layers of NAT (needs configuration)
         2. Local peers inside a NAT can communicate directly
         3. Relaying as a fallback (needs configuration)

More info here:
https://code.google.com/p/badvpn/wiki/badvpn

P. S. It would be nice to see this with easy to use GUI and prepacked
binaries for all "main" systems...

Regards,

M.




From rdohm321 at gmail.com  Thu Dec 26 07:16:17 2013
From: rdohm321 at gmail.com (Randolph)
Date: Thu, 26 Dec 2013 16:16:17 +0100
Subject: [cryptography] The next gen P2P secure email solution
In-Reply-To: <CAD2Ti28L_+F8p0VhR4XCkSGwqvrh0C2L=3cTa0boa_MwTjtSmg@mail.gmail.com>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <CAEvNM8koxGTcvuUVfHdXZ3ewGei0ni3DC1pvqfz2tGX5diSx0Q@mail.gmail.com>
 <CAD2Ti28L_+F8p0VhR4XCkSGwqvrh0C2L=3cTa0boa_MwTjtSmg@mail.gmail.com>
Message-ID: <CAEvNM8k+jbhn655umSZpx9PJeDoxK5ph329Y+tR6CCx_f-L+xw@mail.gmail.com>

Hi Garpamp and Adrelanos,
I agree with you too!.. as I am not affiliated with BitMail, .. all that is
needed, you request.  It seems to be a model like waste.sf.net out as a
reference. The difference maybe is, I tried to evalute it, and we could
share experience. Anyway.., it is definately a p2p email model. Regards
2013/12/25 grarpamp <grarpamp at gmail.com>

> Anyone looked at BitMail p2p ?
> http://sourceforge.net/projects/bitmail/?source=directory

If you need hosting for code,
> lists, website... some code review, testing, etc... just ask. We need more
> cool ideas and software...  need to step
> up to the plate in these areas if you want people to take you seriously.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1221 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131226/5b662c49/attachment.txt>

From hozer at hozed.org  Thu Dec 26 16:25:01 2013
From: hozer at hozed.org (Troy Benjegerdes)
Date: Thu, 26 Dec 2013 18:25:01 -0600
Subject: [tor-talk] Request for "Tor, king of anonymity" graphic
In-Reply-To: <CAFd=HCebvEW6KvgHigdFQtPANc5WyOzS_0WW3r=F4wi8ixLryw@mail.gmail.com>
References: <20131110052942.GB31806@moria.seul.org>
 <52B38971.6060904@redteam.io>
 <CAD2Ti2-56J8=SEYPEo6hA-KSw8fnCWpGJq4Re3vD1L3A6s95Tw@mail.gmail.com>
 <20131224141951.GA32084@loar>
 <CAD2Ti281bgsi8cYsy=86=ERfVW36OY_7cpE3r=FKY+Ro8Omxog@mail.gmail.com>
 <20131224221316.GF3180@nl.grid.coop>
 <CAD2Ti2-dNzRV9PVGq=X+7HaYaYPT8KCtmwee29eF06vX0NZ8ww@mail.gmail.com>
 <20131225193215.GG3180@nl.grid.coop>
 <CAFd=HCebvEW6KvgHigdFQtPANc5WyOzS_0WW3r=F4wi8ixLryw@mail.gmail.com>
Message-ID: <20131227002501.GH3180@nl.grid.coop>

So much for trying to be nice.

Why the fuck are you bending over for people who like to keep secrets?

I like my fucking and my security safe, sane, and consensual. Tor is a
great tool, but too many idiots get caught up in the idea they can use 
it to 'rage against the machine' by using EXACTLY THE SAME TACTICS THE
MACHINE BENDS THEM THE FUCK OVER WITH.

If you truly wish to fuck the NSA, have no secrets, have no fear, and 
choose every action as if the world were watching, for they very well 
may be. 

If you have something to fear, then hide shit. 

If you want to be a real cypherpunk, leave the fear and put your life
and integrity to do everything in plain sight and speak truth to power.

Most likely power will leave you the fuck alone because they it figure
out how to manipulate you with fear, and are to afraid of the power of
truth, for which they have no defense.


On Wed, Dec 25, 2013 at 02:58:30PM -0500, Kelly John Rose wrote:
> Wow, is this seriously political correctness self censorship encouragement
> in the name of security culture based anti psyops?
> 
> And I thought I'd heard it all.
> 
> On Wednesday, December 25, 2013, Troy Benjegerdes wrote:
> 
> > > https://www.youtube.com/results?search_query=richard+pryor
> > >
> > > But you know, let's just decry and ban it all.
> >
> > Go ahead and post it. I'm not stopping you. I am, however, excercising
> > my freedom of speech to try to point out that the image you appear to
> > be defending may be a psy-ops campaign from those who get paid to keep
> > secrets.
> >
> > > > We can do better than bending over for the NSA and saying 'have at it'
> > >
> > > You're right... as torizens, cypherpunks, and whatever else,
> > > bending over for the NSA is definitely not in our interests ;-)
> > > Kinda why people are working to get better at doing it right, baby.
> >
> > My point is that by promoting that image and the culture(s) it represents
> > you may be bending over and broadcasting "Here I am, here's how to control
> > me" to nation-states and email providers that make money based on how many
> > advertising links you click.
> >
> 
> 
> -- 
> Kelly John Rose
> Toronto, ON
> Phone: +1 647 638-4104
> Twitter: @kjrose
> Skype: kjrose.pr
> Gtalk: iam at kjro.se
> MSN: msn at kjro.se
> 
> Document contents are confidential between original recipients and sender.




From privarchy at gmail.com  Fri Dec 27 05:38:53 2013
From: privarchy at gmail.com (Alex J. Martin)
Date: Fri, 27 Dec 2013 13:38:53 +0000
Subject: Article About a Secret Communication Channel in 1980's South Africa
Message-ID: <52BD82ED.2010205@gmail.com>

This should be of interest to the list.
I must credit the find to Schneier's blog: 
https://www.schneier.com/blog/archives/2013/12/operation_vula.html

"Talking to Vula <http://www.anc.org.za/show.php?id=4693>" 
(http://www.anc.org.za/show.php?id=4693) is the story of a 1980s secret 
communications channel between black South African leaders and others 
living in exile in the UK. The system used encrypted text encoded into 
DTMF "touch tones" and transmitted from pay phones.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 897 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131227/8089d2dd/attachment.txt>

From grarpamp at gmail.com  Fri Dec 27 22:24:14 2013
From: grarpamp at gmail.com (grarpamp)
Date: Sat, 28 Dec 2013 01:24:14 -0500
Subject: [p2p-hackers] The next gen P2P secure email solution
In-Reply-To: <52BB76A6.2000606@matthew.at>
References: <CAD2Ti28MwGU_5gLxMUG61En6NT059rWP=Qbk1O74Vc8hTCrLGw@mail.gmail.com>
 <52BB76A6.2000606@matthew.at>
Message-ID: <CAD2Ti2_=4dGaY5SW5oAAToyUWXENirLF=TuPOqxmpJeC_G28fw@mail.gmail.com>

On Wed, Dec 25, 2013 at 7:21 PM, Matthew Kaufman <matthew at matthew.at> wrote:
> So there's already a system that until very recently did peer-to-peer
> delivery of messages over encrypted channels between hosts that participated
> in a peer-to-peer overlay. It was Skype.

Afaik, skype used a central lookup to get to unknown peers, not a DHT.
So they perhaps knew who wanted to talk to who. Of course now skype
is untrusted by anyone with a clue.

> And none of these proposed solutions are viable until there's a solve for
> the very reason that Skype is moving away from P2P technology... and that is
> that the majority of the billions of new users joining the Internet over the
> next few years are doing so with the only Internet-accessing device they
> have: a mobile phone. When they're on WiFi, the bandwidth is good, but they
> sleep most of the time even in that case to preserve their otherwise meager
> battery life... and when they're on 3G/4G, the bandwidth isn't as good and
> it can be very expensive, and it burns the battery up even faster.

Sure, there's a class of users that want this, a big class. They can
have and use their modified legacy centralized email as they wish.
There's another big class that want's something more than that.

We're also going to see faster hardware, lighter code, and maybe
even wearable battery packs... because as you say, these users
want it all and are willing to go to almost any means to get it.

There could also be ways to make the heavier weight anonymous
routing p2p transport let these lightweight clients stub in just to make a
direct p2p connection for encrypted voip/messaging (if say you
published your node as accepting that option).

> These users want to be able to send and receive messages when their device
> is on, but the recipient's device isn't. Because most of the time, the
> recipient's device, even if they put it in their pocket 10 seconds ago, is
> already asleep, trying to preserve as much battery as possible.
>
> That pretty much eliminates all designs that do direct transfer from sender
> to receiver, irrespective of the traffic analysis risks of doing so.
>
> Additionally, it also means that nearly all the participant nodes are also
> unable to participate in a peer-to-peer overlay network, because they can't
> afford the network uptime (and consequent battery drain) necessary.

We're exploring ideas. What is to say we are able to develop into it some
kind of automaton taho-lafs delivery storage nodes. Storing messages in
transit under some expiry policy is not a huge space concern. So who knows.

Maybe everyone with their uber important phones will end
up VPN to their home/colo servers where the horsepower is.

Predicting mobile is hard. Throw more apps out there and your
$30-50/mo unlimited data plans go away. Now is everyone going
to pay $150+/mo for that? Where is free open wifi going to end up
spanning? And so many other things.

What I think is clear is that there will for the far to indefinite forseeable
future be some form of real workstation/laptop in the home and office.
Phones just can't replace that. Maybe we're seeing something in how
you see larger tablet/netbooks/laptops with headsets being carried about
now as if it is natural. And lots of those people will want a highly
secure system to communicate over with their peers in this new
world of disgustingly gratuitous surveillance and databasing.
I would not underestimate the demand for that sort of a comms system.

> So we're back to fetching the email off of servers, and just having the
> paths between the servers be over this magical new peer-to-peer network.
> Only that's already approximately what we have now.

That could be the multimodal thing above. Or the in network thing.

> Oh, and those servers can do interesting things you can't do at the receiver
> nearly so well, like correlate likely spam between recipients and drop it...
> or detect viruses before they're delivered, and drop those.

DSPAM, spamassassin, clamav and the like do fairly well enough
on their own locally.

I suggest not cataloging a defeatist list of what you think you can't
do... but rather what you could do, what you would gain and what
could happen if you build it :)

> ps. And then there's the other unsolved problem: If you do actually build a
> popular service that lets people securely exchange messages, the government
> comes with an order to reveal the content of the messages, and threats to
> lock up the principals if those demands aren't met. I wish I could tell you
> more stories about this, but of course I'm subject to the same sorts of
> non-disclosure that everyone else who's ever gotten one of those is.

That's why you should be doing the development of these new
protocols entirely within existing secure networks such as Tor
and I2P. And why you should bootstrap via peers instead of
clearnet authorities like Tor that can be shutdown... it's a little
less secure, but you can have in network authorities wrapped
in web of trust and then rejoin listening only to them later. And
if clearnet get''s that bad, it becomes a freedom of speech issue
which is well, SHTF time.




From coderman at gmail.com  Sat Dec 28 07:00:08 2013
From: coderman at gmail.com (coderman)
Date: Sat, 28 Dec 2013 07:00:08 -0800
Subject: P2P VPN
In-Reply-To: <52BC459D.9060007@owca.info>
References: <52BC459D.9060007@owca.info>
Message-ID: <CAJVRA1SeoqUAx=41NTdxdPyjj50sUB8ArAo29QSY8GykL38BeQ@mail.gmail.com>

On Thu, Dec 26, 2013 at 7:05 AM, Matej Kovacic <matej.kovacic at owca.info> wrote:
> ...
> this might be of interest to you:
> https://code.google.com/p/badvpn/
> ...
> The VPN part of this project implements a Layer 2 (Ethernet) network
> between the peers (VPN nodes).


i love the concept of L2 VPNs; so pure in theory.
(AppleTalk and IPX over WAN? no problem!)

in practice they need a lot of careful implementation and
configuration.  the attack surface for tap vs. tun is very different;
many services handling broadcast traffic assume a trusted local
network environment.

all of the security features listed on the wiki are related to
transport / authentication rather than endpoint service
considerations.  this should be remedied.

looks interesting! perhaps i can play around with it soon...


best regards,




From coderman at gmail.com  Sat Dec 28 07:14:47 2013
From: coderman at gmail.com (coderman)
Date: Sat, 28 Dec 2013 07:14:47 -0800
Subject: Boycott the RSA Conference - List of Honor
In-Reply-To: <52BC6382.3060307@cypherpunks.to>
References: <52BC6382.3060307@cypherpunks.to>
Message-ID: <CAJVRA1QMs_-QJZP+YqpzwbrhYrcEiHicPoiyqfq_XnTY4LjuEA@mail.gmail.com>

On Thu, Dec 26, 2013 at 9:12 AM, gwen hastings <gwen at cypherpunks.to> wrote:
> ... the RSA Conference is coming to the Bay area yet again,
>
> So far F-secure is worthy of Honor they have chosen to boycott the
> conference, as EVERY HONEST security and crypto firm/personnel should
>  do...
> Let the honor roll grow!!


Josh Thomas also bowing out:
https://twitter.com/m0nk_dot/status/415352004295131136

is anyone keeping track? i'm curious...




From jessetaylor84 at riseup.net  Sun Dec 29 00:17:07 2013
From: jessetaylor84 at riseup.net (Jesse R. Taylor)
Date: Sun, 29 Dec 2013 00:17:07 -0800
Subject: Replacing corporate search engines with anonymous/decentralized search
Message-ID: <1388305027.11664.55.camel@debian>

Recently there has been a lot of focus on the importance of developing
more secure alternatives to email, instant messaging, browsing, etc. ...
but I've seen very little focus on the need for development of
alternatives to corporate search engines. 

Corporate/state control of the Internet involves a three pronged
strategy of: mass surveillance, censorship/criminalization of
undesirable ideas, and traffic shaping (i.e. directing people away of
things you don't want them to see, and towards things you do). Corporate
search engines are implicated in all three of these, i.e. they: 

        1) Monitor what we are searching for
        2) Censor websites by removing them from search engine indexes
        3) Shape traffic via non-transparent algorithms that can sort
        search results in a way that grants prominence to certain types
        of sites (corporate media, etc.), in order to suit the interests
        of multinational corporations and governments.

... so obviously, developing alternatives to corporate search is every
bit as crucial for protecting privacy and free speech as encrypting our
emails/chats, and anonymizing our browsing ...

But I've seen very little information about practical/simple options
that are available for anonymous and decentralized Internet search
software. I've only been able to find a few examples like YaCy, but they
all seem overly complex and unusable by the vast majority of users. What
are the major barriers to creating simple tools (e.g. a plugin for
Firefox) that would enable users to perform anonymous, p2p web search
(even if it's much slower than centralized search) and break away from
using corporate search? Which current efforts to create decentralized
search seem most promising to you from a privacy/security standpoint? 

-- Jesse Taylor
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2111 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131229/cabf3678/attachment.txt>

From coderman at gmail.com  Sun Dec 29 02:19:23 2013
From: coderman at gmail.com (coderman)
Date: Sun, 29 Dec 2013 02:19:23 -0800
Subject: [Full-disclosure] 30c3: The Year in Crypto default engines loaded
 in openssl-1.x through openssl-1.0.1e]
Message-ID: <CAJVRA1RW0DJR6rqWHoiH1hi6gbTwEjbZkxVSV9pBKsVULuyWoA@mail.gmail.com>

in 30c3: The Year in Crypto
 with djb, Nadia Heninger, Tanja Lange
http://www.youtube.com/watch?v=Fty107Us7oc
at ~28min discussion of RDRAND,
 Intel's pass the buck to NIST no-comment,
  (after initial "just trust us, we looked at a lab sample close"
didn't fly far enough...)
alt slides: hyperelliptic.org/tanja/vortraege/talk-30C3.pdf


also, Tor 0.2.4.20 (Mon Dec 23 07:21:35 UTC 2013)
 updates to avoid direct RDRAND use in specific circumstances:
  https://lists.torproject.org/pipermail/tor-talk/2013-December/031483.html
 per previous discussion on OpenSSL use of RDRAND directly when engines on.[0]
  TL; DR - very rare case you may want to re-gen relay and hidden service keys


 now,,
you may wonder if IETF could apply resistance to NSA seducing of NIST,
 but you'd be stepping into a quagmire  :P
  http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/
  http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html
 [specifically, all of Dan Harkins "appeals for legitimacy" bear
striking resemblance to other demonstratively failed approaches to
failure by default designs. Dragonfly is not sufficiently justified.
insert pleas to appeal to decency and step away from CFRG and IETF
authority roles for propriety sake, regardless of any reasonable
claims or other implications best exemplified by RSA[1]]


 also,,
SIMON and SPECK is lulz; no really: fuck those guys!
 and remember that AES GCM is a choice between:
  - user-land side channels galore  /or/
  - hardware instruction back-door
.
.

2013 was indeed a year for crypto
  let's not do this again soon?



best regards,



0. "BADRAND and testing OpenSSL engines enabled behavior with direct
RDRAND engine"
 https://peertech.org/goodrand
BADRAND lets you link a test version of your application or library
against OpenSSL 1.0.1e that uses a specific sequence of deterministic
"random numbers" in OpenSSL. e.g. standard C lib function rand()
seeded at zero replacing RDRAND. the debug logging to stderr can
identify bad fork() assumptions.

1. Dual-EC-DRBG is bad and RSA should feel bad. No excuses.
 https://gist.github.com/0xabad1dea/8101758
 IETF standards not a good reference for "formal proof" level thoroughness,
  and highly deployed does not mean highly used nor scrutinized (WEP,
LEAP, OpenSSL's Dual_EC_DRBG implementation, [the set is large])

X. "see that one top post ..."  [was: RDRAND used directly when...
 On Sat, Dec 14, 2013 at 4:33 AM, coderman <coderman at gmail.com> wrote:
> as per the FreeBSD announcement[0] and others[1][2] direct use of
> RDRAND as sole entropy source is not recommended...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




From eric at konklone.com  Sun Dec 29 00:39:18 2013
From: eric at konklone.com (Eric Mill)
Date: Sun, 29 Dec 2013 03:39:18 -0500
Subject: Replacing corporate search engines with anonymous/decentralized
 search
In-Reply-To: <1388305027.11664.55.camel@debian>
References: <1388305027.11664.55.camel@debian>
Message-ID: <CANBOYLUSGmz_ifpa-as7QSWjknTdNr7S0Hm5qLPDqYu0zmbcjw@mail.gmail.com>

Right now, I'd even settle for a competitive, interesting marketplace of
corporate search engines.


On Sun, Dec 29, 2013 at 3:17 AM, Jesse R. Taylor
<jessetaylor84 at riseup.net>wrote:

>  Recently there has been a lot of focus on the importance of developing
> more secure alternatives to email, instant messaging, browsing, etc. ...
> but I've seen very little focus on the need for development of alternatives
> to corporate search engines.
>
> Corporate/state control of the Internet involves a three pronged strategy
> of: mass surveillance, censorship/criminalization of undesirable ideas, and
> traffic shaping (i.e. directing people away of things you don't want them
> to see, and towards things you do). Corporate search engines are implicated
> in all three of these, i.e. they:
>
> 1) Monitor what we are searching for
> 2) Censor websites by removing them from search engine indexes
> 3) Shape traffic via non-transparent algorithms that can sort search
> results in a way that grants prominence to certain types of sites
> (corporate media, etc.), in order to suit the interests of multinational
> corporations and governments.
>
> ... so obviously, developing alternatives to corporate search is every bit
> as crucial for protecting privacy and free speech as encrypting our
> emails/chats, and anonymizing our browsing ...
>
> But I've seen very little information about practical/simple options that
> are available for anonymous and decentralized Internet search software.
> I've only been able to find a few examples like YaCy, but they all seem
> overly complex and unusable by the vast majority of users. What are the
> major barriers to creating simple tools (e.g. a plugin for Firefox) that
> would enable users to perform anonymous, p2p web search (even if it's much
> slower than centralized search) and break away from using corporate search?
> Which current efforts to create decentralized search seem most promising to
> you from a privacy/security standpoint?
>
> -- Jesse Taylor <http://www.interference.cc>
>



-- 
konklone.com | @konklone <https://twitter.com/konklone>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2717 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131229/963bbc1d/attachment.txt>

From coderman at gmail.com  Sun Dec 29 10:43:46 2013
From: coderman at gmail.com (coderman)
Date: Sun, 29 Dec 2013 10:43:46 -0800
Subject: automated crash reporting XKeyscore hooks
Message-ID: <CAJVRA1TXp7QbqUM2ospAFPUkJfU4He1kQ3LWTDmq9DjmyFFwfQ@mail.gmail.com>

seems automated processes are a great XKeyscore source:

"in practical terms, the NSA's agents... enjoy it because it allows
them [a "neat way" to gain "passive access" to a machine] ... In one
internal graphic, they replaced the text of Microsoft's original error
message with one of their own reading, "This information may be
intercepted by a foreign sigint system to gather detailed information
and better exploit your machine."


---
http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969-druck.html

Inside TAO

Documents Reveal Top NSA Hacking Unit

By SPIEGEL Staff

The NSA's TAO hacking unit is considered to be the intelligence
agency's top secret weapon. It maintains its own covert network,
infiltrates computers around the world and even intercepts shipping
deliveries to plant back doors in electronics ordered by those it is
targeting.

In January 2010, numerous homeowners in San Antonio, Texas, stood
baffled in front of their closed garage doors. They wanted to drive to
work or head off to do their grocery shopping, but their garage door
openers had gone dead, leaving them stranded. No matter how many times
they pressed the buttons, the doors didn't budge. The problem
primarily affected residents in the western part of the city, around
Military Drive and the interstate highway known as Loop 410.

In the United States, a country of cars and commuters, the mysterious
garage door problem quickly became an issue for local politicians.
Ultimately, the municipal government solved the riddle. Fault for the
error lay with the United States' foreign intelligence service, the
National Security Agency, which has offices in San Antonio. Officials
at the agency were forced to admit that one of the NSA's radio
antennas was broadcasting at the same frequency as the garage door
openers. Embarrassed officials at the intelligence agency promised to
resolve the issue as quickly as possible, and soon the doors began
opening again.

It was thanks to the garage door opener episode that Texans learned
just how far the NSA's work had encroached upon their daily lives. For
quite some time now, the intelligence agency has maintained a branch
with around 2,000 employees at Lackland Air Force Base, also in San
Antonio. In 2005, the agency took over a former Sony computer chip
plant in the western part of the city. A brisk pace of construction
commenced inside this enormous compound. The acquisition of the former
chip factory at Sony Place was part of a massive expansion the agency
began after the events of Sept. 11, 2001.

On-Call Digital Plumbers

One of the two main buildings at the former plant has since housed a
sophisticated NSA unit, one that has benefited the most from this
expansion and has grown the fastest in recent years -- the Office of
Tailored Access Operations, or TAO. This is the NSA's top operative
unit -- something like a squad of plumbers that can be called in when
normal access to a target is blocked.

According to internal NSA documents viewed by SPIEGEL, these on-call
digital plumbers are involved in many sensitive operations conducted
by American intelligence agencies. TAO's area of operations ranges
from counterterrorism to cyber attacks to traditional espionage. The
documents reveal just how diversified the tools at TAO's disposal have
become -- and also how it exploits the technical weaknesses of the IT
industry, from Microsoft to Cisco and Huawei, to carry out its
discreet and efficient attacks.

The unit is "akin to the wunderkind of the US intelligence community,"
says Matthew Aid, a historian who specializes in the history of the
NSA. "Getting the ungettable" is the NSA's own description of its
duties. "It is not about the quantity produced but the quality of
intelligence that is important," one former TAO chief wrote,
describing her work in a document. The paper seen by SPIEGEL quotes
the former unit head stating that TAO has contributed "some of the
most significant intelligence our country has ever seen." The unit, it
goes on, has "access to our very hardest targets."

A Unit Born of the Internet

Defining the future of her unit at the time, she wrote that TAO "needs
to continue to grow and must lay the foundation for integrated
Computer Network Operations," and that it must "support Computer
Network Attacks as an integrated part of military operations." To
succeed in this, she wrote, TAO would have to acquire "pervasive,
persistent access on the global network." An internal description of
TAO's responsibilities makes clear that aggressive attacks are an
explicit part of the unit's tasks. In other words, the NSA's hackers
have been given a government mandate for their work. During the middle
part of the last decade, the special unit succeeded in gaining access
to 258 targets in 89 countries -- nearly everywhere in the world. In
2010, it conducted 279 operations worldwide.

Indeed, TAO specialists have directly accessed the protected networks
of democratically elected leaders of countries. They infiltrated
networks of European telecommunications companies and gained access to
and read mails sent over Blackberry's BES email servers, which until
then were believed to be securely encrypted. Achieving this last goal
required a "sustained TAO operation," one document states.

This TAO unit is born of the Internet -- created in 1997, a time when
not even 2 percent of the world's population had Internet access and
no one had yet thought of Facebook, YouTube or Twitter. From the time
the first TAO employees moved into offices at NSA headquarters in Fort
Meade, Maryland, the unit was housed in a separate wing, set apart
from the rest of the agency. Their task was clear from the beginning
-- to work around the clock to find ways to hack into global
communications traffic.

Recruiting the Geeks

To do this, the NSA needed a new kind of employee. The TAO workers
authorized to access the special, secure floor on which the unit is
located are for the most part considerably younger than the average
NSA staff. Their job is breaking into, manipulating and exploiting
computer networks, making them hackers and civil servants in one. Many
resemble geeks -- and act the part too.

Indeed, it is from these very circles that the NSA recruits new hires
for its Tailored Access Operations unit. In recent years, NSA Director
Keith Alexander has made several appearances at major hacker
conferences in the United States. Sometimes, Alexander wears his
military uniform, but at others, he even dons jeans and a t-shirt in
his effort to court trust and a new generation of employees.

The recruitment strategy seems to have borne fruit. Certainly, few if
any other divisions within the agency are growing as quickly as TAO.
There are now TAO units in Wahiawa, Hawaii; Fort Gordon, Georgia; at
the NSA's outpost at Buckley Air Force Base, near Denver, Colorado; at
its headquarters in Fort Meade; and, of course, in San Antonio.

One trail also leads to Germany. According to a document dating from
2010 that lists the "Lead TAO Liaisons" domestically and abroad as
well as names, email addresses and the number for their "Secure
Phone," a liaison office is located near Frankfurt -- the European
Security Operations Center (ESOC) at the so-called "Dagger Complex" at
a US military compound in the Griesheim suburb of Darmstadt.

But it is the growth of the unit's Texas branch that has been uniquely
impressive, the top secret documents reviewed by SPIEGEL show. These
documents reveal that in 2008, the Texas Cryptologic Center employed
fewer than 60 TAO specialists. By 2015, the number is projected to
grow to 270 employees. In addition, there are another 85 specialists
in the "Requirements & Targeting" division (up from 13 specialists in
2008). The number of software developers is expected to increase from
the 2008 level of three to 38 in 2015. The San Antonio office handles
attacks against targets in the Middle East, Cuba, Venezuela and
Colombia, not to mention Mexico, just 200 kilometers (124 miles) away,
where the government has fallen into the NSA's crosshairs.

Targeting Mexico

Mexico's Secretariat of Public Security, which was folded into the new
National Security Commission at the beginning of 2013, was responsible
at the time for the country's police, counterterrorism, prison system
and border police. Most of the agency's nearly 20,000 employees worked
at its headquarters on Avenida Constituyentes, an important traffic
artery in Mexico City. A large share of the Mexican security
authorities under the auspices of the Secretariat are supervised from
the offices there, making Avenida Constituyentes a one-stop shop for
anyone seeking to learn more about the country's security apparatus.

Operation WHITETAMALE

That considered, assigning the TAO unit responsible for tailored
operations to target the Secretariat makes a lot of sense. After all,
one document states, the US Department of Homeland Security and the
United States' intelligence agencies have a need to know everything
about the drug trade, human trafficking and security along the
US-Mexico border. The Secretariat presents a potential "goldmine" for
the NSA's spies, a document states. The TAO workers selected systems
administrators and telecommunications engineers at the Mexican agency
as their targets, thus marking the start of what the unit dubbed
Operation WHITETAMALE.

Workers at NSA's target selection office, which also had Angela Merkel
in its sights in 2002 before she became chancellor, sent TAO a list of
officials within the Mexican Secretariat they thought might make
interesting targets. As a first step, TAO penetrated the target
officials' email accounts, a relatively simple job. Next, they
infiltrated the entire network and began capturing data.

Soon the NSA spies had knowledge of the agency's servers, including IP
addresses, computers used for email traffic and individual addresses
of diverse employees. They also obtained diagrams of the security
agencies' structures, including video surveillance. It appears the
operation continued for years until SPIEGEL first reported on it in
October.

The technical term for this type of activity is "Computer Network
Exploitation" (CNE). The goal here is to "subvert endpoint devices,"
according to an internal NSA presentation that SPIEGEL has viewed. The
presentation goes on to list nearly all the types of devices that run
our digital lives -- "servers, workstations, firewalls, routers,
handsets, phone switches, SCADA systems, etc." SCADAs are industrial
control systems used in factories, as well as in power plants. Anyone
who can bring these systems under their control has the potential to
knock out parts of a country's critical infrastructure.

The most well-known and notorious use of this type of attack was the
development of Stuxnet, the computer worm whose existence was
discovered in June 2010. The virus was developed jointly by American
and Israeli intelligence agencies to sabotage Iran's nuclear program,
and successfully so. The country's nuclear program was set back by
years after Stuxnet manipulated the SCADA control technology used at
Iran's uranium enrichment facilities in Natanz, rendering up to 1,000
centrifuges unusable.

The special NSA unit has its own development department in which new
technologies are developed and tested. This division is where the real
tinkerers can be found, and their inventiveness when it comes to
finding ways to infiltrate other networks, computers and smartphones
evokes a modern take on Q, the legendary gadget inventor in James Bond
movies.

Having Fun at Microsoft's Expense

One example of the sheer creativity with which the TAO spies approach
their work can be seen in a hacking method they use that exploits the
error-proneness of Microsoft's Windows. Every user of the operating
system is familiar with the annoying window that occasionally pops up
on screen when an internal problem is detected, an automatic message
that prompts the user to report the bug to the manufacturer and to
restart the program. These crash reports offer TAO specialists a
welcome opportunity to spy on computers.

When TAO selects a computer somewhere in the world as a target and
enters its unique identifiers (an IP address, for example) into the
corresponding database, intelligence agents are then automatically
notified any time the operating system of that computer crashes and
its user receives the prompt to report the problem to Microsoft. An
internal presentation suggests it is NSA's powerful XKeyscore spying
tool that is used to fish these crash reports out of the massive sea
of Internet traffic.

The automated crash reports are a "neat way" to gain "passive access"
to a machine, the presentation continues. Passive access means that,
initially, only data the computer sends out into the Internet is
captured and saved, but the computer itself is not yet manipulated.
Still, even this passive access to error messages provides valuable
insights into problems with a targeted person's computer and, thus,
information on security holes that might be exploitable for planting
malware or spyware on the unwitting victim's computer.

Although the method appears to have little importance in practical
terms, the NSA's agents still seem to enjoy it because it allows them
to have a bit of a laugh at the expense of the Seattle-based software
giant. In one internal graphic, they replaced the text of Microsoft's
original error message with one of their own reading, "This
information may be intercepted by a foreign sigint system to gather
detailed information and better exploit your machine." ("Sigint"
stands for "signals intelligence.")

One of the hackers' key tasks is the offensive infiltration of target
computers with so-called implants or with large numbers of Trojans.
They've bestowed their spying tools with illustrious monikers like
"ANGRY NEIGHBOR," "HOWLERMONKEY" or "WATERWITCH." These names may
sound cute, but the tools they describe are both aggressive and
effective.

According to details in Washington's current budget plan for the US
intelligence services, around 85,000 computers worldwide are projected
to be infiltrated by the NSA specialists by the end of this year. By
far the majority of these "implants" are conducted by TAO teams via
the Internet.

Increasing Sophistication

Until just a few years ago, NSA agents relied on the same methods
employed by cyber criminals to conduct these implants on computers.
They sent targeted attack emails disguised as spam containing links
directing users to virus-infected websites. With sufficient knowledge
of an Internet browser's security holes -- Microsoft's Internet
Explorer, for example, is especially popular with the NSA hackers --
all that is needed to plant NSA malware on a person's computer is for
that individual to open a website that has been specially crafted to
compromise the user's computer. Spamming has one key drawback though:
It doesn't work very often.

Nevertheless, TAO has dramatically improved the tools at its disposal.
It maintains a sophisticated toolbox known internally by the name
"QUANTUMTHEORY." "Certain QUANTUM missions have a success rate of as
high as 80%, where spam is less than 1%," one internal NSA
presentation states.

A comprehensive internal presentation titled "QUANTUM CAPABILITIES,"
which SPIEGEL has viewed, lists virtually every popular Internet
service provider as a target, including Facebook, Yahoo, Twitter and
YouTube. "NSA QUANTUM has the greatest success against Yahoo, Facebook
and static IP addresses," it states. The presentation also notes that
the NSA has been unable to employ this method to target users of
Google services. Apparently, that can only be done by Britain's GCHQ
intelligence service, which has acquired QUANTUM tools from the NSA.

A favored tool of intelligence service hackers is "QUANTUMINSERT."
GCHQ workers used this method to attack the computers of employees at
partly government-held Belgian telecommunications company Belgacom, in
order to use their computers to penetrate even further into the
company's networks. The NSA, meanwhile, used the same technology to
target high-ranking members of the Organization of the Petroleum
Exporting Countries (OPEC) at the organization's Vienna headquarters.
In both cases, the trans-Atlantic spying consortium gained unhindered
access to valuable economic data using these tools.

The NSA's Shadow Network

The insert method and other variants of QUANTUM are closely linked to
a shadow network operated by the NSA alongside the Internet, with its
own, well-hidden infrastructure comprised of "covert" routers and
servers. It appears the NSA also incorporates routers and servers from
non-NSA networks into its covert network by infecting these networks
with "implants" that then allow the government hackers to control the
computers remotely. (Click here to read a related article on the NSA's
"implants".)

In this way, the intelligence service seeks to identify and track its
targets based on their digital footprints. These identifiers could
include certain email addresses or website cookies set on a person's
computer. Of course, a cookie doesn't automatically identify a person,
but it can if it includes additional information like an email
address. In that case, a cookie becomes something like the web
equivalent of a fingerprint.

A Race Between Servers

Once TAO teams have gathered sufficient data on their targets' habits,
they can shift into attack mode, programming the QUANTUM systems to
perform this work in a largely automated way. If a data packet
featuring the email address or cookie of a target passes through a
cable or router monitored by the NSA, the system sounds the alarm. It
determines what website the target person is trying to access and then
activates one of the intelligence service's covert servers, known by
the codename FOXACID.

This NSA server coerces the user into connecting to NSA covert systems
rather than the intended sites. In the case of Belgacom engineers,
instead of reaching the LinkedIn page they were actually trying to
visit, they were also directed to FOXACID servers housed on NSA
networks. Undetected by the user, the manipulated page transferred
malware already custom tailored to match security holes on the target
person's computer.

The technique can literally be a race between servers, one that is
described in internal intelligence agency jargon with phrases like:
"Wait for client to initiate new connection," "Shoot!" and "Hope to
beat server-to-client response." Like any competition, at times the
covert network's surveillance tools are "too slow to win the race."
Often enough, though, they are effective. Implants with QUANTUMINSERT,
especially when used in conjunction with LinkedIn, now have a success
rate of over 50 percent, according to one internal document.

Tapping Undersea Cables

At the same time, it is in no way true to say that the NSA has its
sights set exclusively on select individuals. Of even greater interest
are entire networks and network providers, such as the fiber optic
cables that direct a large share of global Internet traffic along the
world's ocean floors.

One document labeled "top secret" and "not for foreigners" describes
the NSA's success in spying on the "SEA-ME-WE-4" cable system. This
massive underwater cable bundle connects Europe with North Africa and
the Gulf states and then continues on through Pakistan and India, all
the way to Malaysia and Thailand. The cable system originates in
southern France, near Marseille. Among the companies that hold
ownership stakes in it are France Telecom, now known as Orange and
still partly government-owned, and Telecom Italia Sparkle.

The document proudly announces that, on Feb. 13, 2013, TAO
"successfully collected network management information for the
SEA-Me-We Undersea Cable Systems (SMW-4)." With the help of a "website
masquerade operation," the agency was able to "gain access to the
consortium's management website and collected Layer 2 network
information that shows the circuit mapping for significant portions of
the network."

It appears the government hackers succeeded here once again using the
QUANTUMINSERT method.

The document states that the TAO team hacked an internal website of
the operator consortium and copied documents stored there pertaining
to technical infrastructure. But that was only the first step. "More
operations are planned in the future to collect more information about
this and other cable systems," it continues.

But numerous internal announcements of successful attacks like the one
against the undersea cable operator aren't the exclusive factors that
make TAO stand out at the NSA. In contrast to most NSA operations,
TAO's ventures often require physical access to their targets. After
all, you might have to directly access a mobile network transmission
station before you can begin tapping the digital information it
provides.

Spying Traditions Live On

To conduct those types of operations, the NSA works together with
other intelligence agencies such as the CIA and FBI, which in turn
maintain informants on location who are available to help with
sensitive missions. This enables TAO to attack even isolated networks
that aren't connected to the Internet. If necessary, the FBI can even
make an agency-owned jet available to ferry the high-tech plumbers to
their target. This gets them to their destination at the right time
and can help them to disappear again undetected after even as little
as a half hour's work.

Responding to a query from SPIEGEL, NSA officials issued a statement
saying, "Tailored Access Operations is a unique national asset that is
on the front lines of enabling NSA to defend the nation and its
allies." The statement added that TAO's "work is centered on computer
network exploitation in support of foreign intelligence collection."
The officials said they would not discuss specific allegations
regarding TAO's mission.

Sometimes it appears that the world's most modern spies are just as
reliant on conventional methods of reconnaissance as their
predecessors.

Take, for example, when they intercept shipping deliveries. If a
target person, agency or company orders a new computer or related
accessories, for example, TAO can divert the shipping delivery to its
own secret workshops. The NSA calls this method interdiction. At these
so-called "load stations," agents carefully open the package in order
to load malware onto the electronics, or even install hardware
components that can provide backdoor access for the intelligence
agencies. All subsequent steps can then be conducted from the comfort
of a remote computer.

These minor disruptions in the parcel shipping business rank among the
"most productive operations" conducted by the NSA hackers, one top
secret document relates in enthusiastic terms. This method, the
presentation continues, allows TAO to obtain access to networks
"around the world."

Even in the Internet Age, some traditional spying methods continue to live on.

REPORTED BY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH,
CHRISTIAN STÖCKER, JÖRG SCHINDLER AND HOLGER STARK

URL:

http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969.html




From coderman at gmail.com  Mon Dec 30 05:03:19 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 05:03:19 -0800
Subject: 30c3: To Protect And Infect, Part 2
Message-ID: <CAJVRA1QsrPx0b-Ab=C8GQhEFS8oKP+Yx42yqnBeg4dY7mRFmNg@mail.gmail.com>

so much asking for names, details, conspirators.

so many months and months of nearly zero satisfaction.


... until:

kudos Jake for delivering; specifically. :)

"[QI vector] 30c3: To Protect And Infect, Part 2"
http://www.youtube.com/watch?v=b0w36GAyZIA


---


you can argue some subset of these attacks are exercised in a targeted
manner, however, this does nothing to prevent collateral damage to
domestic and global individuals, indiscriminately.

fuck these guys![0]



best regards,



0. fuck you, at least in so far as your offensive efforts to undermine
privacy and liberty in the name of route tasking without restraint.
 to those who go privacy tech repurpose, i will sing your praises and
support your efforts!




From coderman at gmail.com  Mon Dec 30 07:21:26 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 07:21:26 -0800
Subject: trojan hardware (keyboard black bag implant) circa 2003
Message-ID: <CAJVRA1RWE3BFAJR0+CnFoX5WqVZrddrn=R9cfRVGF6nuXOv8Rw@mail.gmail.com>

out of time, barest gist til next year: back when doing wifi security
research and other interests [trunc.] received an FBI black bag job;
presumably physical focus due to non standard OSes and FDE.  IBM
keyboard internal chip replaced with identical logging variant; note
that this is not as sophisticated as the more recent TAO toys with
covert RF channels and active, on-demand capabilities...

the keyboard tampering:
https://peertech.org/dist/baghw04.jpg
https://peertech.org/dist/baghw05.jpg
https://peertech.org/dist/baghw06.jpg
 which is for all intents and purposes otherwise visually undetectable
using this trojan chip technique, tailored for every common
manufacturer.

while that was not bad, aside from leaking tamper event, the FDE was
so sad/funny. a screw amuck, replacement drive significantly different
(when compared to identical lot mate purchased with original that got
yanked for offline attack)
https://peertech.org/dist/baghw01.jpg
https://peertech.org/dist/baghw02.jpg
https://peertech.org/dist/baghw03.jpg


---


in a round about manner this was all instigated in part by wifi
research done at the time which put various powerful entities into a
tiff.  here's what the pacNW sample looked like back in early 2003:
https://peertech.org/archives/wifi-scan/
"Cleartext Nodes: 8755 (62.59%)
  , WEP Nodes: 5232 (37.40%)"
 ... ah, memories :)


---


one last fun learning by example: consider that you thwart direct
physical access black bag type attempts, and are not running a
vulnerable router/CPE, and present a sufficiently compelling target,
you may encounter a clever "just outside the property line" isolation
and active attack on DOCSIS uplink. (a broadcast medium is hard to
mess with in a covert manner, unless you're able to isolate target
from the local broadcast loop itself.)

https://peertech.org/dist/docsis-mitm.jpg
(circa 2007 - make note of image comments and also single "Comcast
tech" shielding self behind door...)




From coderman at gmail.com  Mon Dec 30 07:38:41 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 07:38:41 -0800
Subject: trojan hardware (keyboard black bag implant) circa 2003
In-Reply-To: <CAJVRA1RWE3BFAJR0+CnFoX5WqVZrddrn=R9cfRVGF6nuXOv8Rw@mail.gmail.com>
References: <CAJVRA1RWE3BFAJR0+CnFoX5WqVZrddrn=R9cfRVGF6nuXOv8Rw@mail.gmail.com>
Message-ID: <CAJVRA1QE8Oei8R6qpsu2X-Yo1dfG7PknUa781DTXpc2tJ=D2BQ@mail.gmail.com>

On Mon, Dec 30, 2013 at 7:21 AM, coderman <coderman at gmail.com> wrote:
> ...
> the keyboard tampering:

tamper evidence combined with secondary reference copies to compare
(buy two in cash on demand rather than shipped, use second as fallback
(vastly more frequent scenario) or as reference with sketch kit (what
did you did? ;)

this leads to the question i intended but omitted in prev:
to date most FBI/NSA/IC keyloggers have been visually obtuse dongle
type, varied software type, particularly for Windows, Mac, and Dos at
this point in the past.  the top class (effectively undetectable?)
hardware keyloggers appear to have avoided detailed disclosure.


is anyone aware of leaked hardware keylogger specs or ops in the veign
of magic lantern / CIPAV / Carnivore / DCS* category applied to covert
hardware based compromises?




From coderman at gmail.com  Mon Dec 30 07:43:21 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 07:43:21 -0800
Subject: trojan hardware (keyboard black bag implant) circa 2003
In-Reply-To: <CAJVRA1QE8Oei8R6qpsu2X-Yo1dfG7PknUa781DTXpc2tJ=D2BQ@mail.gmail.com>
References: <CAJVRA1RWE3BFAJR0+CnFoX5WqVZrddrn=R9cfRVGF6nuXOv8Rw@mail.gmail.com>
 <CAJVRA1QE8Oei8R6qpsu2X-Yo1dfG7PknUa781DTXpc2tJ=D2BQ@mail.gmail.com>
Message-ID: <CAJVRA1QVZJQAjn8rXzmWSsmaT701LDw3xjAFPS+8dUhS=ms9Sw@mail.gmail.com>

On Mon, Dec 30, 2013 at 7:38 AM, coderman <coderman at gmail.com> wrote:
>...
> is anyone aware of leaked hardware keylogger specs or ops ...
> applied to covert hardware based compromises?

COTTONMOUTH is informative; but generally USB based and visible via
spectrum when actively exfilling.

specifically hardware attacks on PS/2 / XT style keyboards.




From jamesdbell8 at yahoo.com  Mon Dec 30 15:15:14 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Mon, 30 Dec 2013 15:15:14 -0800 (PST)
Subject: Jacob Appelbaum in Germany
Message-ID: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>



http://www.newsmax.com/Newsfront/NSA-Surveillance/2013/12/30/id/544431

Privacy Advocate Exposes High-Tech NSA Spy Gadgets 
Monday, 30 Dec 2013 03:43 PM
 
Share: 
	* 

A well-known privacy advocate has given the public an 
unusually explicit peek into the intelligence world's tool box, pulling 
back the curtain on the National Security Agency's arsenal of high-tech 
spy gear.
Independent journalist and security expert Jacob Appelbaum on Monday 
told a hacker conference in Germany that the NSA could turn iPhones into eavesdropping tools and use radar wave devices to harvest electronic 
information from computer even if they weren't online.
Appelbaum told hundreds of computer experts gathered at Hamburg's 
Chaos Communications Conference that his revelations about the NSA's 
capabilities "are even worse than your worst nightmares."
"What I am going to show you today is wrist-slittingly depressing," he said.
Even though in the past six months there have been an unprecedented 
level of public scrutiny of the NSA and its methods, Appelbaum's claims — supported by what appeared to be internal NSA slideshows — still caused a stir.
One of the slides described how the NSA can plant malicious software 
onto Apple Inc.'s iPhone, giving American intelligence agents the 
ability to turn the popular smartphone into a pocket-sized spy.
Another slide showcased a futuristic-sounding device described as a 
"portable continuous wave generator," a remote controlled device which — when paired with tiny electronic implants — can bounce invisible waves 
of energy off keyboards and monitors to see what is being typed even if 
the target device isn't connected to the Internet.
A third slide showcased a piece of equipment called NIGHTSTAND, which can tamper with wireless Internet connections from up to 8 miles away.
An NSA spokeswoman Vanee Vines said that she wasn't aware of 
Appelbaum's presentation, but that in general should would not comment 
on "alleged foreign intelligence activities."
"As we've said before:  NSA's focus is on targeting the 
communications of valid foreign intelligence targets — not on collecting and exploiting a class of communications or services that would sweep 
up communications that are not of bona fide foreign intelligence 
interest to the U.S. government."
The documents included in Appelbaum's presentation were first published by German magazine Der Spiegel Sunday and Monday.
Appelbaum and Der Spiegel have both played an important role in the 
disclosures of NSA leaker Edward Snowden, but neither has clarified 
whether the most recent set of slides came from Snowden.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4666 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131230/7bdec7fb/attachment.txt>

From seanl at literati.org  Mon Dec 30 16:00:11 2013
From: seanl at literati.org (Sean Lynch)
Date: Mon, 30 Dec 2013 16:00:11 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <CAHKdp-=cEvoDiQLagUChmXKL_ZCn6zHCQdH3NuC6DbmgXpxmbQ@mail.gmail.com>

The talk is titled "To Protect and Infect Part 2" and video is available at
http://streaming.media.ccc.de/congress/2013/webm/30c3-5713-en-de-To_Protect_And_Infect_Part_2_webm.webm

If you can't view WebM you can find other formats by looking around in
parent directories.


On Mon, Dec 30, 2013 at 3:15 PM, Jim Bell <jamesdbell8 at yahoo.com> wrote:

>
> http://www.newsmax.com/Newsfront/NSA-Surveillance/2013/12/30/id/544431<http:///>
> Privacy Advocate Exposes High-Tech NSA Spy Gadgets
>    Monday, 30 Dec 2013 03:43 PM
>
>     Share:
>  <http://www.newsmax.com/Newsfront/NSA-Surveillance/2013/12/30/id/544431#>
>
>    -
>
>
>   A well-known privacy advocate has given the public an unusually
> explicit peek into the intelligence world's tool box, pulling back the
> curtain on the National Security Agency's arsenal of high-tech spy gear.
> Independent journalist and security expert Jacob Appelbaum on Monday told
> a hacker conference in Germany that the NSA could turn iPhones into
> eavesdropping tools and use radar wave devices to harvest electronic
> information from computer even if they weren't online.
> Appelbaum told hundreds of computer experts gathered at Hamburg's Chaos
> Communications Conference that his revelations about the NSA's capabilities
> "are even worse than your worst nightmares."
> "What I am going to show you today is wrist-slittingly depressing," he
> said.
> Even though in the past six months there have been an unprecedented level
> of public scrutiny of the NSA and its methods, Appelbaum's claims —
> supported by what appeared to be internal NSA slideshows — still caused a
> stir.
> One of the slides described how the NSA can plant malicious software onto
> Apple Inc.'s iPhone, giving American intelligence agents the ability to
> turn the popular smartphone into a pocket-sized spy.
> Another slide showcased a futuristic-sounding device described as a
> "portable continuous wave generator," a remote controlled device which —
> when paired with tiny electronic implants — can bounce invisible waves of
> energy off keyboards and monitors to see what is being typed even if the
> target device isn't connected to the Internet.
> A third slide showcased a piece of equipment called NIGHTSTAND, which can
> tamper with wireless Internet connections from up to 8 miles away.
> An NSA spokeswoman Vanee Vines said that she wasn't aware of Appelbaum's
> presentation, but that in general should would not comment on "alleged
> foreign intelligence activities."
> "As we've said before: NSA's focus is on targeting the communications of
> valid foreign intelligence targets — not on collecting and exploiting a
> class of communications or services that would sweep up communications that
> are not of bona fide foreign intelligence interest to the U.S. government."
> The documents included in Appelbaum's presentation were first published by
> German magazine Der Spiegel Sunday and Monday.
> Appelbaum and Der Spiegel have both played an important role in the
> disclosures of NSA leaker Edward Snowden, but neither has clarified whether
> the most recent set of slides came from Snowden.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4908 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131230/27d30b24/attachment.txt>

From griffin at cryptolab.net  Mon Dec 30 17:56:57 2013
From: griffin at cryptolab.net (griffin at cryptolab.net)
Date: Mon, 30 Dec 2013 20:56:57 -0500
Subject: "To Protect and Infect" - the edges of privacy-invading technology
Message-ID: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>

   This talk is divided into two parts.  Morgan Marquis-Boire and Claudio 
Guarnieri talking about the militarization of the internet in part one, 
including both targeted and dragnet surveillance in deep-packet 
inspection.  (See also Citizen Labs' work on BlueCoat).  In part two, 
Jake Appelbaum talks about some of the most hardcore and cutting-edge 
NSA surveillance tactics and equipment.  (See also yesterday's Der 
Spiegel articles).

Part 1: http://www.youtube.com/watch?v=XZYo9TPyNko

Part 2: https://www.youtube.com/watch?v=b0w36GAyZIA

best,
Griffin

-- 
As always, opinions are mine and kittens are cuddly :3

Seriously, go take a kitten break: 
https://www.youtube.com/results?search_query=fluffy+kittens




From coderman at gmail.com  Mon Dec 30 22:06:25 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 22:06:25 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>

...

hey Jim, (and Jake)

neither one of you appear to have a *coin tipjar yet...

why holding out? :)



best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 498 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131230/c8d65777/attachment.txt>

From coderman at gmail.com  Mon Dec 30 22:19:21 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 22:19:21 -0800
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <20131231051456.GC25536@order.stressinduktion.org>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
Message-ID: <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>

On Mon, Dec 30, 2013 at 9:14 PM, Hannes Frederic Sowa
<hannes at stressinduktion.org> wrote:
> ...
> Actually, somehow, I have a feeling of relief to see that major hardware
> vendors don't seem to specifically work hand in hand with the NSA to
> implement backdoors.

you're assuming this dump is exhaustive.  this is a very specifically
themed/focused release of top end tactics and exploits (essentially
weaponized platforms for targeted attacks). Jake says as much about
what they're dropping, which while impressive, has still gone through
the "best interest of public safety scrutinizing and censorship"
rigmarole.

the indiscriminate, wholesale compromises are just getting started...
these disclosures will have more impact: financially to the impacted
vendors, effectively to IC as known vulnerable hardware and software
is replaced, and to the public at large now exposed to even more
essentially incomprehensible disclosures of vulnerability and
compromise.



> I don't see that having a JTAG connector publicaly
> accessible on a RAID controller as a hint for that. The other disclosures
> also point to my conclusion that the NSA is mostly working on their
> own. Of course, not all of Snowden's documents are released yet and
> hence my feeling could be deceiving.

this is just an example of how, when the NSA pursues "all means and
methods in parallel, without restraint" seemingly innocuous oversights
are intentionally leveraged and discouraged from remediation for use
in tailored access (black bag / targeted) attacks.



> I thought it could be worse.

it is worse.


best regards,


p.s. cryptome has lots of great docs on this and other 30C3 awesomeness:
  http://cryptome.org/ , http://cryptome.org/2013/12/nsa-catalog.zip




From jamesdbell8 at yahoo.com  Mon Dec 30 23:09:04 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Mon, 30 Dec 2013 23:09:04 -0800 (PST)
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
Message-ID: <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>

Sorry to appear so ignorant, but what is a "*coin tipjar"?
        Jim Bell




________________________________
 From: coderman <coderman at gmail.com>
To: Jim Bell <jamesdbell8 at yahoo.com>; Jacob Appelbaum <jacob at appelbaum.net> 
Cc: "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
Sent: Monday, December 30, 2013 10:06 PM
Subject: Re: Jacob Appelbaum in Germany
 


...

hey Jim, (and Jake)

neither one of you appear to have a *coin tipjar yet...

why holding out? :)



best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2010 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131230/8e96497f/attachment.txt>

From coderman at gmail.com  Mon Dec 30 23:21:14 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 23:21:14 -0800
Subject: Replacing corporate search engines with anonymous/decentralized
 search
In-Reply-To: <1388305027.11664.55.camel@debian>
References: <1388305027.11664.55.camel@debian>
Message-ID: <CAJVRA1R-=089gF0eSMDU=O=wn2v3QFjPjASzm-353NF9EGYRFw@mail.gmail.com>

On Sun, Dec 29, 2013 at 12:17 AM, Jesse R. Taylor
<jessetaylor84 at riseup.net> wrote:
> Recently there has been a lot of focus on the importance of developing more
> secure alternatives to email, instant messaging, browsing, etc. ... but I've
> seen very little focus on the need for development of alternatives to
> corporate search engines.

decentralized search (not just not-corporate search) persists as one
of the great
practical challenges in peer to peer networking.

i have more to say later, but one effort from back in early 2000 is alpine:
  https://peertech.org/alpine
 inside the 2004 snapshot there is also docs and implementation of
feedbackfs which is used to gather implicit feedback on recommendation
/ discovery of file based resources.


alpine is explicitly highly connected, flatter than not network
topology to improve robustness in the face of failure and active
attacks, and to avoid limitations inherent in many connection oriented
operating system facilities/sockets.


i am not quite an impartial party ;)
 but other approaches which are not a feasible replacement include:
 - the old skewl (mostly)flooding broadcasts like gnutella
 - fragile, hard to defend constructs like DHTs as keyword indexes
 - aggressive caching with local search (110% useful, but not sufficient alone)
 - distributed (but better somehow) search engines on darknets, etc.
these are more about search privacy or deep search more than
decentralized search.



> But I've seen very little information about practical/simple options that
> are available for anonymous and decentralized Internet search software.
> ... What are the major barriers to creating simple tools [...]
> [... for] anonymous, p2p web search (even if it's much slower
> than centralized search) and break away from using corporate search? Which
> current efforts to create decentralized search seem most promising to you
> from a privacy/security standpoint?


the longer discussion is how to make decentralized search useful.
"Google style" search has a terrific performance advantage over
decentralized designs by brute force.

however, take advantage of massive endpoint / peer processing and
resources combined with implicit observational metrics for reputation
and recommendation, inside a well integrated framework for resource
discovery in usable software, and you have something more robust and
more effective than "Google style" could ever provide.

this is quite the trick, however!  despite an inter-operable component
model interface, and dynamic runtime module support to extend
discovery and wire protocol extensions, and other intentional efforts
at encouraging adoption and integration, alpine failed to bootstrap.
(i did many things wrong, but those things i did at least make
conscious effort to do right.  did i mention this is a hard problem?
:)


this project has been excavated from archives, and will receive
maintenance upgrades[0] at minimum and significant improvement a
possible option, depending.


best regards,


[0] maintenance work for testable alpine builds
 - fix/improve g++ usage.
 - add IPv6 support. (specifically ORCHID addrs for darknet search)
 - update feedbackfs to latest fusefs bindings
 - update inotify bindings in feedbackfs
 - multiple-socket support, multi-addr discovery




From coderman at gmail.com  Mon Dec 30 23:27:53 2013
From: coderman at gmail.com (coderman)
Date: Mon, 30 Dec 2013 23:27:53 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>

On Mon, Dec 30, 2013 at 11:09 PM, Jim Bell <jamesdbell8 at yahoo.com> wrote:
> Sorry to appear so ignorant, but what is a "*coin tipjar"?

its a way to convert digital shared hallucinations into fiat
denominated shared hallucinations.

for an example exchange in BTC network:
  http://www.michaelnielsen.org/ddi/how-the-bitcoin-protocol-actually-works/

you can generate your own wallet and use your own client directly in
network, or use a managed wallet service, or a conversion service that
immediately converts into $USD denominated deposits in a bank account,
or exchange for physical token representations of the coin/funds, etc.

http://lovebitcoins.org/ is probably the most accessible place to start,
 and github where the good forks are if you're in the ready to hack camp.


if you setup a wallet and tell me the address, i can donate coins for
you to experiment with.



best regards,




From coderman at gmail.com  Tue Dec 31 00:51:27 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 00:51:27 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
Message-ID: <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>

On Tue, Dec 31, 2013 at 12:32 AM, Griffin Boyce <griffin at cryptolab.net> wrote:
>...
>   I prefer my shared hallucinations to be in the form of Lindens [1], ...


i'll let you cypherpunks in on a secret financial tip:
  the smart money banks in dogecoin: http://dogecoin.com/




From jamesdbell8 at yahoo.com  Tue Dec 31 00:58:07 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 00:58:07 -0800 (PST)
Subject: Fw: Jacob Appelbaum in Germany
In-Reply-To: <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>

Having had "*coin tipjar" explained to me, I have set up a BTC receive address.    "jim btc tipjar"      1AzNPQ1NhiD9uG1hU5g5Kdaccb88Dus2Bo

    Please note:  This address is the BTC tipjar for "Jim Bell", "James Dalton Bell", living at 7214 Corregidor, Vancouver WA 98664.  (phone and cell on request; As far as I know I'm listed.  I've never had an unlisted/unpublished phone number.).   Ham Call N7IJS (apparently I am the LAST "Tech-Plus" in existence; the FCC has refused to re-up my 2010 license application, but the laws say I can still do ham.)


    Note Also:  Having been on (and off) the Cypherpunks list since 1995 (mostly off, of course), I understand that a reasonable sense of caution will make many of you think, "Is this REALLY the 'Jim Bell' who wrote the AP essay, etc?"   For those who doubt, I have Skype set up to do a voice videophone.  There is a picture of me, in a green sweater, taken by Declan McCullagh about June 2000 on the web; I haven't changed a lot.  (I even have my green sweater, too!).  
       Jim 



Disclaimer:    I am not associated with 'Sanjuro's "Assassination Market" in any way.  I don't know who 'Sanjuro' is.  





----- Forwarded Message -----
From: Jim Bell <jamesdbell8 at yahoo.com>
To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Monday, December 30, 2013 11:09 PM
Subject: Re: Jacob Appelbaum in Germany
 


Sorry to appear so ignorant, but what is a "*coin tipjar"?
        Jim Bell



________________________________
 From: coderman <coderman at gmail.com>
To: Jim Bell <jamesdbell8 at yahoo.com>; Jacob Appelbaum <jacob at appelbaum.net> 
Cc: "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
Sent: Monday, December 30, 2013 10:06 PM
Subject: Re: Jacob Appelbaum in Germany
 


...

hey Jim, (and Jake)

neither one of you appear to have a *coin tipjar yet...

why holding out? :)



best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 6458 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/e0d184e8/attachment.txt>

From joe_wang at yahoo.com  Tue Dec 31 01:19:38 2013
From: joe_wang at yahoo.com (Joe Wang)
Date: Tue, 31 Dec 2013 01:19:38 -0800 (PST)
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
Message-ID: <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>

hey Jim, that is too much information.  In this age less is more. :)  Can't you just use pgp to sign the email and whoever wants to verify can do so?
 
-Joe


________________________________
 From: Jim Bell <jamesdbell8 at yahoo.com>
To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Tuesday, December 31, 2013 4:58 PM
Subject: Fw: Jacob Appelbaum in Germany
 


Having had "*coin tipjar" explained to me, I have set up a BTC receive address.    "jim btc tipjar"      1AzNPQ1NhiD9uG1hU5g5Kdaccb88Dus2Bo

    Please note:  This address is the BTC tipjar for "Jim Bell", "James Dalton Bell", living at 7214 Corregidor, Vancouver WA 98664.  (phone and cell on request; As far as I know I'm listed.  I've never had an unlisted/unpublished phone number.).   Ham Call N7IJS (apparently I am the LAST "Tech-Plus" in existence; the FCC has refused to re-up my 2010 license application, but the laws say I can still do ham.)


    Note Also:  Having been on (and off) the Cypherpunks list since 1995 (mostly off, of course), I understand that a reasonable sense of caution will make many of you think, "Is this REALLY the 'Jim Bell' who wrote the AP essay, etc?"   For those who doubt, I have Skype set up to do a voice videophone.  There is a picture of me, in a green sweater, taken by Declan McCullagh about June 2000 on the web; I haven't changed a lot.  (I even have my green sweater, too!).  
       Jim 



Disclaimer:    I am not associated with 'Sanjuro's "Assassination Market" in any way.  I don't know who 'Sanjuro' is.  





----- Forwarded Message -----
From: Jim Bell <jamesdbell8 at yahoo.com>
To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Monday, December 30, 2013 11:09 PM
Subject: Re: Jacob Appelbaum in Germany
 


Sorry to appear so ignorant, but what is a "*coin tipjar"?
        Jim Bell



________________________________
 From: coderman <coderman at gmail.com>
To: Jim Bell <jamesdbell8 at yahoo.com>; Jacob Appelbaum <jacob at appelbaum.net> 
Cc: "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
Sent: Monday, December 30, 2013 10:06 PM
Subject: Re: Jacob Appelbaum in Germany
 


...

hey Jim, (and Jake)

neither one of you appear to have a *coin tipjar yet...

why holding out? :)



best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 8265 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/bdcbd7b0/attachment.txt>

From jamesdbell8 at yahoo.com  Tue Dec 31 01:46:15 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 01:46:15 -0800 (PST)
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>
Message-ID: <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>

I currently do not have a PGP key.  This lack is not entirely due to laziness or ignorance.  I also don't know anybody locally who has a PGP key, so I can't enter into the 'web of trust'.  And having been so long disassociated with the CP list (and computers, too:  Having been stuck in prison or denied access to computers for most of 15 years), I don't even recall how to do it.  
I have another reason to not 'do' PGP:  Particularly due to the (unexpected) arrival of this 'Sanjuro' person, I am well aware that there are probably more than a few Feds who are on ultra-high alert, and from their point of view they may think of me as being "Suspect #1".  If I go back and start using PGP again (even if only for signing things) I wonder what they will think.  At the moment I have little need for secrecy, so I choose to not do PGP.
(Also, I am virtually assuming that everything on my computer can be, and probably is, being read by a few dozen spy organizations of technically-competent nations.  I use ordinary anti-virus programs, but I'm under no illusion that the NSA/CIA/GCHQ/TLA's of other nations can't devise a targeted bug that such software cannot find.)     If any of you are interested in helping me confirm or deny this paranoid suspicion, I would very much appreciate your assistance.)
        Jim Bell




________________________________
 From: Joe Wang <joe_wang at yahoo.com>
To: Jim Bell <jamesdbell8 at yahoo.com>; coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Tuesday, December 31, 2013 1:19 AM
Subject: Re: Jacob Appelbaum in Germany
 


hey Jim, that is too much information.  In this age less is more. :)  Can't you just use pgp to sign the email and whoever wants to verify can do so?
 
-Joe


________________________________
 From: Jim Bell <jamesdbell8 at yahoo.com>
To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Tuesday, December 31, 2013 4:58 PM
Subject: Fw: Jacob Appelbaum in Germany
 


Having had "*coin tipjar" explained to me, I have set up a BTC receive address.    "jim btc tipjar"      1AzNPQ1NhiD9uG1hU5g5Kdaccb88Dus2Bo

    Please note:  This address is the BTC tipjar for "Jim Bell", "James Dalton Bell", living at 7214 Corregidor, Vancouver WA 98664.  (phone and cell on request; As far as I know I'm listed.  I've never had an unlisted/unpublished phone number.).   Ham Call N7IJS (apparently I am the LAST "Tech-Plus" in existence; the FCC has refused to re-up my 2010 license application, but the laws say I can still do ham.)


    Note Also:  Having been on (and off) the Cypherpunks list since 1995 (mostly off, of course), I understand that a reasonable sense of caution will make many of you think, "Is this REALLY the 'Jim Bell' who wrote the AP essay, etc?"   For those who doubt, I have Skype set up to do a voice videophone.  There is a picture of me, in a green sweater, taken by Declan McCullagh about June 2000 on the web; I haven't changed a lot.  (I even have my green sweater, too!).  
       Jim 



Disclaimer:    I am not associated with 'Sanjuro's "Assassination Market" in any way.  I don't know who 'Sanjuro' is.  





----- Forwarded Message -----
From: Jim Bell <jamesdbell8 at yahoo.com>
To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Monday, December 30, 2013 11:09 PM
Subject: Re: Jacob Appelbaum in Germany
 


Sorry to appear so ignorant, but what is a "*coin tipjar"?
        Jim Bell



________________________________
 From: coderman <coderman at gmail.com>
To: Jim Bell <jamesdbell8 at yahoo.com>; Jacob Appelbaum <jacob at appelbaum.net> 
Cc: "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
Sent: Monday, December 30, 2013 10:06 PM
Subject: Re: Jacob Appelbaum in Germany
 


...

hey Jim, (and Jake)

neither one of you appear to have a *coin tipjar yet...

why holding out? :)



best regards,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 10831 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/436bb088/attachment.txt>

From coderman at gmail.com  Tue Dec 31 02:47:45 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 02:47:45 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <6BDC09B6-D059-449B-9B83-9E6BAA88F89F@riseup.net>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <6BDC09B6-D059-449B-9B83-9E6BAA88F89F@riseup.net>
Message-ID: <CAJVRA1TW19xHTzDFNgfN=d6ng9utUND=mcNX8HUFW8o_aL2dRQ@mail.gmail.com>

On Tue, Dec 31, 2013 at 1:23 AM, cypherpunks <cypherpunks at riseup.net> wrote:
>...
> Some of your stuff is at cpunks.wordpress.com and at JYA cryptome.org as
> well.


also,
  https://peertech.org/dist/cypherpunks-199209-199812.tar.bz2
sha256 579c3059e24b2d65f324053b0fed550a9d1d4fb2504a1a272940a26697ed8a33


(where else is the above mirrored? i had links, they're no longer good...)


best regards,




From coderman at gmail.com  Tue Dec 31 03:08:12 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 03:08:12 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>
 <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <CAJVRA1SmjdyYOiVX+ZFyzw=_YMG1qekQ9hmqJXUr9Lv0hxc13Q@mail.gmail.com>

On Tue, Dec 31, 2013 at 1:46 AM, Jim Bell <jamesdbell8 at yahoo.com> wrote:
> I currently do not have a PGP key. ...  If I go back and start
> using PGP again (even if only for signing things) I wonder what they will
> think.  At the moment I have little need for secrecy, so I choose to not do
> PGP.


this makes sense, and leads to a question; see below.


> (Also, I am virtually assuming that everything on my computer can be, and
> probably is, being read by a few dozen spy organizations of
> technically-competent nations.  I use ordinary anti-virus programs, but I'm
> under no illusion that the NSA/CIA/GCHQ/TLA's of other nations can't devise
> a targeted bug that such software cannot find.)     If any of you are
> interested in helping me confirm or deny this paranoid suspicion, I would
> very much appreciate your assistance.)


so far we've seen 0.5%[0] of confirmations of general and nearly
insurmountable vulnerability against a state level actor, ... let's
see what 2014 has in store! :)



the question:
 do you believe the counter-surveillance was a factor in the extreme
measures used in your prosecution?
AP seemed the most controversial and outwardly demonised aspect of the
whole debacle, but perhaps i am giving too much weight to AP.

the judge sealing the entire court file raises questions, but i also
admit knowing little about the particulars of the facts and legal
motions of the case.


best regards,



0.  snowden leaks, ~1.6% to ~.40% released
  http://cryptome.org/2013/11/snowden-tally.htm
   see also, tailored access megapwnage:
http://cryptome.org/2013/12/nsa-tao-ant.pdf
http://cryptome.org/2013/12/nsa-quantum-tasking.pdf
http://cryptome.org/2013/12/nsa-quantumtheory.pdf
http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf
http://cryptome.org/2013/12/nsa-tao-ant-pdf.pdf
http://cryptome.org/2013/12/nsa-catalog.zip
http://cryptome.org/2013/12/nsa-ant-bildschirm.pdf
http://cryptome.org/2013/12/nsa-ant-w-lan.pdf
http://cryptome.org/2013/12/nsa-ant-usb.pdf
http://cryptome.org/2013/12/nsa-ant-tastatu.pdf
http://cryptome.org/2013/12/nsa-ant-server.pdf
http://cryptome.org/2013/12/nsa-ant-router.pdf
http://cryptome.org/2013/12/nsa-ant-rechner.pdf
http://cryptome.org/2013/12/nsa-ant-raumuber.pdf
http://cryptome.org/2013/12/nsa-ant-mobilfunk.pdf
http://cryptome.org/2013/12/nsa-ant-handys.pdf
http://cryptome.org/2013/12/nsa-ant-firewalls.pdf




From griffin at cryptolab.net  Tue Dec 31 00:32:47 2013
From: griffin at cryptolab.net (Griffin Boyce)
Date: Tue, 31 Dec 2013 03:32:47 -0500
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
Message-ID: <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>

coderman ha scritto:
   Jim Bell <jamesdbell8 at yahoo.com> wrote:
>> Sorry to appear so ignorant, but what is a "*coin tipjar"?
> its a way to convert digital shared hallucinations into fiat
> denominated shared hallucinations.

   I prefer my shared hallucinations to be in the form of Lindens [1], 
where at least my pretend money can be put to use to buy myself a fancy 
pretend dress, decorate my pretend house, or take part in pretend masked 
balls (until the server crashes, anyway).  Much like modern fiat 
currency, Lindens are commonly earned through menial labor and sexwork, 
though of course currency conversion is the most popular method of 
obtaining them. Like Bitcoin you can buy your way in, and unlike 
Bitcoin, the currency conversion process is straightforward.  The 
perceived value of Lindens is tightly controlled by their governing 
body, while Bitcoin's perceived value is dictated by media interest and 
speculation.

~Griffin

[1] http://en.wikipedia.org/wiki/Linden_Dollar#Economic_issues




From griffin at cryptolab.net  Tue Dec 31 01:54:20 2013
From: griffin at cryptolab.net (Griffin Boyce)
Date: Tue, 31 Dec 2013 04:54:20 -0500
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
Message-ID: <fbbd7cca7ef9a36ea310aeff6a88e00b@cryptolab.net>

Il 31.12.2013 03:51 coderman ha scritto:
> i'll let you cypherpunks in on a secret financial tip:
>   the smart money banks in dogecoin: http://dogecoin.com/
              ▄              ▄
             ▌▒█           ▄▀▒▌
  such coin  ▌▒▒█        ▄▀▒▒▒▐
            ▐▄▀▒▒▀▀▀▀▄▄▄▀▒▒▒▒▒▐ very
          ▄▄▀▒░▒▒▒▒▒▒▒▒▒█▒▒▄█▒▐   crypto
        ▄▀▒▒▒░░░▒▒▒░░░▒▒▒▀██▀▒▌
       ▐▒▒▒▄▄▒▒▒▒░░░▒▒▒▒▒▒▒▀▄▒▒▌
       ▌░░▌█▀▒▒▒▒▒▄▀█▄▒▒▒▒▒▒▒█▒▐
      ▐░░░▒▒▒▒▒▒▒▒▌██▀▒▒░░░▒▒▒▀▄▌
      ▌░▒▄██▄▒▒▒▒▒▒▒▒▒░░░░░░▒▒▒▒▌
     ▀▒▀▐▄█▄█▌▄░▀▒▒░░░░░░░░░░▒▒▒▐ doge tax?
     ▐▒▒▐▀▐▀▒░▄▄▒▄▒▒▒▒▒▒░▒░▒░▒▒▒▒▌
     ▐▒▒▒▀▀▄▄▒▒▒▄▒▒▒▒▒▒▒▒░▒░▒░▒▒▐
      ▌▒▒▒▒▒▒▀▀▀▒▒▒▒▒▒░▒░▒░▒░▒▒▒▌
      ▐▒▒▒▒▒▒▒▒▒▒▒▒▒▒░▒░▒░▒▒▄▒▒▐ dread
       ▀▄▒▒▒▒▒▒▒▒▒▒▒░▒░▒░▒▄▒▒▒▒▌ pirate
         ▀▄▒▒▒▒▒▒▒▒▒▒▄▄▄▀▒▒▒▒▄▀ dogeberts
           ▀▄▄▄▄▄▄▀▀▀▒▒▒▒▒▄▄▀
cypherdoge   ▒▒▒▒▒▒▒▒▒▒▀▀





From hannes at stressinduktion.org  Mon Dec 30 21:14:56 2013
From: hannes at stressinduktion.org (Hannes Frederic Sowa)
Date: Tue, 31 Dec 2013 06:14:56 +0100
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
Message-ID: <20131231051456.GC25536@order.stressinduktion.org>

On Mon, Dec 30, 2013 at 08:56:57PM -0500, griffin at cryptolab.net wrote:
>   This talk is divided into two parts.  Morgan Marquis-Boire and Claudio 
> Guarnieri talking about the militarization of the internet in part one, 
> including both targeted and dragnet surveillance in deep-packet 
> inspection.  (See also Citizen Labs' work on BlueCoat).  In part two, 
> Jake Appelbaum talks about some of the most hardcore and cutting-edge 
> NSA surveillance tactics and equipment.  (See also yesterday's Der 
> Spiegel articles).
> 
> Part 1: http://www.youtube.com/watch?v=XZYo9TPyNko
> 
> Part 2: https://www.youtube.com/watch?v=b0w36GAyZIA

Actually, somehow, I have a feeling of relief to see that major hardware
vendors don't seem to specifically work hand in hand with the NSA to
implement backdoors. I don't see that having a JTAG connector publicaly
accessible on a RAID controller as a hint for that. The other disclosures
also point to my conclusion that the NSA is mostly working on their
own. Of course, not all of Snowden's documents are released yet and
hence my feeling could be deceiving.

I thought it could be worse.

Bye,

  Hannes




From hannes at stressinduktion.org  Mon Dec 30 22:01:43 2013
From: hannes at stressinduktion.org (Hannes Frederic Sowa)
Date: Tue, 31 Dec 2013 07:01:43 +0100
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <20131231051456.GC25536@order.stressinduktion.org>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
Message-ID: <20131231060143.GA30313@order.stressinduktion.org>

On Tue, Dec 31, 2013 at 06:14:56AM +0100, Hannes Frederic Sowa wrote:
> On Mon, Dec 30, 2013 at 08:56:57PM -0500, griffin at cryptolab.net wrote:
> >   This talk is divided into two parts.  Morgan Marquis-Boire and Claudio 
> > Guarnieri talking about the militarization of the internet in part one, 
> > including both targeted and dragnet surveillance in deep-packet 
> > inspection.  (See also Citizen Labs' work on BlueCoat).  In part two, 
> > Jake Appelbaum talks about some of the most hardcore and cutting-edge 
> > NSA surveillance tactics and equipment.  (See also yesterday's Der 
> > Spiegel articles).
> > 
> > Part 1: http://www.youtube.com/watch?v=XZYo9TPyNko
> > 
> > Part 2: https://www.youtube.com/watch?v=b0w36GAyZIA
> 
> Actually, somehow, I have a feeling of relief to see that major hardware
> vendors don't seem to specifically work hand in hand with the NSA to
> implement backdoors. I don't see that having a JTAG connector publicaly
> accessible on a RAID controller as a hint for that. The other disclosures
> also point to my conclusion that the NSA is mostly working on their
> own. Of course, not all of Snowden's documents are released yet and
> hence my feeling could be deceiving.

Also:

>From the talk I got the impression, that attacks on iPhones always seem
to work. The slide from der Spiegel shows that this infection only works
via close access method and a remote infection path would be available in the
future (the slide is from 2008, but we don't know if this actually exists
now):
http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/Handy/S3222_DROPOUTJEEP.jpg

I guess the slide got accidentally chopped off in the talk or am I missing
something?

The UPD+RC6 story does not make sense to me, too (how could they know
about the encryption algorithm if they didn't dissect the actual bytes). I
also don't believe that current state of TLS would help much preventing
those redirection attacks.

Greetings,

  Hannes




From anthony at cajuntechie.org  Tue Dec 31 07:47:46 2013
From: anthony at cajuntechie.org (Anthony Papillion)
Date: Tue, 31 Dec 2013 09:47:46 -0600
Subject: Jacob Appelbaum in Germany
In-Reply-To: <006601cf063d$0d4e9820$27ebc860$@net>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
Message-ID: <BLU0-SMTP1052D0A0D638846F955332EA0C90@phx.gbl>

Yeah, it was tragic. Probaby $10 was stolen in that heist...lol

On 12/31/2013 09:29 AM, Silent1 wrote:
> Ahh, Dogecoin, didn't an online wallet service of theirs get hacked last
> week and completely cleaned out of hundreds of thousands of coins?
> 
> -----Original Message-----
> From: cypherpunks [mailto:cypherpunks-bounces at cpunks.org] On Behalf Of
> coderman
> Sent: Tuesday, December 31, 2013 8:51 AM
> To: Griffin Boyce
> Cc: cpunks
> Subject: Re: Jacob Appelbaum in Germany
> 
> On Tue, Dec 31, 2013 at 12:32 AM, Griffin Boyce <griffin at cryptolab.net>
> wrote:
>> ...
>>   I prefer my shared hallucinations to be in the form of Lindens [1], ...
> 
> 
> i'll let you cypherpunks in on a secret financial tip:
>   the smart money banks in dogecoin: http://dogecoin.com/
> 
> 
> 




From billstclair at gmail.com  Tue Dec 31 07:19:50 2013
From: billstclair at gmail.com (Bill St. Clair)
Date: Tue, 31 Dec 2013 10:19:50 -0500
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1TW19xHTzDFNgfN=d6ng9utUND=mcNX8HUFW8o_aL2dRQ@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <6BDC09B6-D059-449B-9B83-9E6BAA88F89F@riseup.net>
 <CAJVRA1TW19xHTzDFNgfN=d6ng9utUND=mcNX8HUFW8o_aL2dRQ@mail.gmail.com>
Message-ID: <CAARJRB5O+eEuzG03df2FZu6FHASpc6yMLMFXoKms6dRdKgop4w@mail.gmail.com>

On Tue, Dec 31, 2013 at 5:47 AM, coderman <coderman at gmail.com> wrote:


> also,
>   https://peertech.org/dist/cypherpunks-199209-199812.tar.bz2
> sha256 579c3059e24b2d65f324053b0fed550a9d1d4fb2504a1a272940a26697ed8a33
>
> (where else is the above mirrored? i had links, they're no longer good...)
>

Just mirrored it at
https://billstclair.com/cypherpunks-199209-199812.tar.bz2
Linked from the index page, as "Cypherpunks archive, September 1992 to
December 1998".

-Bill
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1075 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/e2c1b590/attachment.txt>

From jd.cypherpunks at gmail.com  Tue Dec 31 02:13:43 2013
From: jd.cypherpunks at gmail.com (jd.cypherpunks at gmail.com)
Date: Tue, 31 Dec 2013 11:13:43 +0100
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>
 <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <8B8F49D9-637C-4DDF-BCF6-ACAFAF554CEA@gmail.com>

Hi Jim,

still love your sense of humour.

All the best
--Michael

PS Some of your old stuff is at cpunks.wordpress.com and at JYA cryptome.org as well.


31.12.2013 10:46 Jim Bell <jamesdbell8 at yahoo.com>:

> I currently do not have a PGP key.  This lack is not entirely due to laziness or ignorance.  I also don't know anybody locally who has a PGP key, so I can't enter into the 'web of trust'.  And having been so long disassociated with the CP list (and computers, too:  Having been stuck in prison or denied access to computers for most of 15 years), I don't even recall how to do it.  
> I have another reason to not 'do' PGP:  Particularly due to the (unexpected) arrival of this 'Sanjuro' person, I am well aware that there are probably more than a few Feds who are on ultra-high alert, and from their point of view they may think of me as being "Suspect #1".  If I go back and start using PGP again (even if only for signing things) I wonder what they will think.  At the moment I have little need for secrecy, so I choose to not do PGP.
> (Also, I am virtually assuming that everything on my computer can be, and probably is, being read by a few dozen spy organizations of technically-competent nations.  I use ordinary anti-virus programs, but I'm under no illusion that the NSA/CIA/GCHQ/TLA's of other nations can't devise a targeted bug that such software cannot find.)     If any of you are interested in helping me confirm or deny this paranoid suspicion, I would very much appreciate your assistance.)
>         Jim Bell
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 5503 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/f5830458/attachment.txt>

From jamesdbell8 at yahoo.com  Tue Dec 31 11:40:34 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 11:40:34 -0800 (PST)
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1SmjdyYOiVX+ZFyzw=_YMG1qekQ9hmqJXUr9Lv0hxc13Q@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>	<CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>	<1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>	<1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>	<1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>	<1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1SmjdyYOiVX+ZFyzw=_YMG1qekQ9hmqJXUr9Lv0hxc13Q@mail.gmail.com>
Message-ID: <1388518834.60388.YahooMailNeo@web141205.mail.bf1.yahoo.com>

From: coderman <coderman at gmail.com>
To: Jim Bell <jamesdbell8 at yahoo.com> 
Cc: Joe Wang <joe_wang at yahoo.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
Sent: Tuesday, December 31, 2013 3:08 AM
Subject: Re: Jacob Appelbaum in Germany
 

>On Tue, Dec 31, 2013 at 1:46 AM, Jim Bell <jamesdbell8 at yahoo.com> wrote:
>> (Also, I am virtually assuming that everything on my computer can be, and
>> probably is, being read by a few dozen spy organizations of
>> technically-competent nations.  I use ordinary anti-virus programs, but I'm
>> under no illusion that the NSA/CIA/GCHQ/TLA's of other nations can't devise
>> a targeted bug that such software cannot find.)     If any of you are
>> interested in helping me confirm or deny this paranoid suspicion, I would
> >very much appreciate your assistance.)

>so far we've seen 0.5%[0] of confirmations of general and nearly
>insurmountable vulnerability against a state level actor, ... let's
>see what 2014 has in store! :)
>the question:
>do you believe the counter-surveillance was a factor in the extreme
>measures used in your prosecution?
>AP seemed the most controversial and outwardly demonised aspect of the
>whole debacle, but perhaps i am giving too much weight to AP.

    I think my 'counter-surveillance' was a factor, but not in the way most (relatively uninformed) people might think.  You see, upon my release in April 2000, I strongly suspected that the Feds had been engaging in corruption and illegal actions against me (Google 'Ryan Thomas Lund'; also, it's in the July 2003 re-filing of my lawsuit 'Revision 1.06'   http://cryptome.org/jdb-v-usa-106.htm     ) and I publicly announced that I would be investigating the facts and would eventually file a lawsuit. Primarily, during the summer of 2000, I visited the last-registered-addresses of vehicles that had been used on Father's Day Sunday 1998 to surveill me when I drove to a relative's house to attend her birthday party.  I suspected that those vehicles had been acquired by the Feds, and that they WOULDN'T be found at their last registered address.  (I had the Oregon DMV database on CDROM).  Turns out, I was absolutely correct.   (see, for example, 
 http://reason.com/archives/2001/12/01/counter-surveillance   )
    What I DIDN'T know (in April 2000) was that since June 1999, the Feds had been faking an appeal in the 9th Circuit court of appeals (case 99-30210).  Quite literally, the appeal was initiated, and from the record it would have appeared that I was trying to handle the appeal myself.  But nobody told me about that appeal, and in fact at least a couple dozen pieces of legal mail that should have come to me at (first) Seatac FDC jail, and subsequently Phoenix FCI prison, were stolen (never delivered) by the Bureau of Prisons (BOP) staff.  Further, I knew nothing of the law at that time.   (Note:  This version of the lawsuit was finalized under trying circumstances just days after I had first read the docket for appeal case 99-30210, so I couldn't write in detail about that fake appeal.  Subsequent amendments (around September 2004, as I recall) were far more detailed in my accusations.)
  The number of Federal felonies that were committed against me must have been immense.  Why they initiated, and kept secret, this fake appeal case, I still do not know.  But _THEY_ KNEW what they had done.  And, in about April 2000, I wrote a letter to the Ninth Circuit (still entirely unaware of case 99-30210) asking for an appeal in the underlying probation-revocation case.  (97-5270).  (I had been told by a 'jailhouse lawyer' in about January 2000 that I had a right to an appeal of that case).  At the time, I didn't know that to get an appeal, I'd have had to ask for an appeal (send in a "Notice of Appeal" document) within 10 working days of the 'entry of judgment' on the case.  I hadn't done that, and by the rules they would have been able to refuse me that appeal.  EXCEPT that there was ALREADY an appeal going, 99-30210!   And my request for an appeal, coupled with my public statements that I suspected corruption, probably put a world of
 fear into those who had been committing those crimes against me.  They knew I was on their track, and they presumably were afraid that I would discover what they had done.
    What I think was done was this:  They assigned a corrupt lawyer, ostensibly to represent me, "Jonathan Solovy", after having RE-forged the docket for appeal 99-30210 (probably in May 2000).  Solovy's job, as I later derived, was to APPEAR to write and file that appeal.  He did, and he lost.  But he didn't send me a copy of the docket for that case.  Had he done so, or had he asked me one of one hundred questions ("I see you've been working on this appeal for 10 months!  What are your appeal issues...?) I would have been instantly alerted that I hadn't initiated that appeal in April 2000, as I thought I had.  Solovy's job was to conceal from me the corrupt nature of the events around appeal 99-30210, and he did so.  I found out the true nature of fake appeal 99-30210 about June 20, 2003, after I received a copy of the docket for that case from the clerks' office of the 9th Circuit Court of Appeals.
     

>the judge sealing the entire court file raises questions, but i also
>admit knowing little about the particulars of the facts and legal
>motions of the case.

The corrupt lawyer, Robert Leen, was assigned to me about November 21, 2000.  I learned early that he didn't intend to actually defend me.  I sent a letter to the (corrupt) judge Tanner about December 8, 2000, telling him that I had 'fired' Leen.  Tanner's response was to refuse to let me fire Leen.  At that point, I realized that I would be fighting not merely the prosecution, but also 'my' attorney and the judge.  I began learning the law, and put a lot of effort into self-written motions and objections.  I even filed a 'Notice of Interlocutory Appeal' in late March 2001, just before my 'trial', which divested jurisdiction from that court to proceed.  Naturally, they simply ignored this, Leen, prosecutor Robb London (who currently works as the Communications Director at Harvard Law School), and judge Tanner.    Much of this is described in my lawsuit.   http://cryptome.org/jdb-v-usa-106.htm
Like I said, the level of corruption used against me was immense.
         Jim bell










0.  snowden leaks, ~1.6% to ~.40% released
  http://cryptome.org/2013/11/snowden-tally.htm
   see also, tailored access megapwnage:
http://cryptome.org/2013/12/nsa-tao-ant.pdf
http://cryptome.org/2013/12/nsa-quantum-tasking.pdf
http://cryptome.org/2013/12/nsa-quantumtheory.pdf
http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf
http://cryptome.org/2013/12/nsa-tao-ant-pdf.pdf
http://cryptome.org/2013/12/nsa-catalog.zip
http://cryptome.org/2013/12/nsa-ant-bildschirm.pdf
http://cryptome.org/2013/12/nsa-ant-w-lan.pdf
http://cryptome.org/2013/12/nsa-ant-usb.pdf
http://cryptome.org/2013/12/nsa-ant-tastatu.pdf
http://cryptome.org/2013/12/nsa-ant-server.pdf
http://cryptome.org/2013/12/nsa-ant-router.pdf
http://cryptome.org/2013/12/nsa-ant-rechner.pdf
http://cryptome.org/2013/12/nsa-ant-raumuber.pdf
http://cryptome.org/2013/12/nsa-ant-mobilfunk.pdf
http://cryptome.org/2013/12/nsa-ant-handys.pdf
http://cryptome.org/2013/12/nsa-ant-firewalls.pdf
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 11394 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/46877771/attachment.txt>

From jamesdbell8 at yahoo.com  Tue Dec 31 11:59:05 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 11:59:05 -0800 (PST)
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
Message-ID: <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>

I am an alum of MIT (Class of 1980; Chemistry).  I've just read the Wikipedia article on Aaron Swartz, and I am very sympathetic to him.   I wish I'd been aware of his situation while he was alive; I might have been able to help, and would have tried to do so.
          Jim Bell




________________________________
 From: Cari Machet <carimachet at gmail.com>
To: Silent1 <lists at silent1.net> 
Cc: cpunks <cypherpunks at cpunks.org> 
Sent: Tuesday, December 31, 2013 8:03 AM
Subject: Re: Jacob Appelbaum in Germany
 

dear sir

we are reaching out to MIT alumni to make a public call of outrage re
among other things the aaron swartz treatment by MIT would u b willing
to b included?

specifically we would b asking for shifts in functionality not just
complaining to the bricks

THANKS


On 12/31/13, Silent1 <lists at silent1.net> wrote:
> Ahh, Dogecoin, didn't an online wallet service of theirs get hacked last
> week and completely cleaned out of hundreds of thousands of coins?
>
> -----Original Message-----
> From: cypherpunks [mailto:cypherpunks-bounces at cpunks.org] On Behalf Of
> coderman
> Sent: Tuesday, December 31, 2013 8:51 AM
> To: Griffin Boyce
> Cc: cpunks
> Subject: Re: Jacob Appelbaum in Germany
>
> On Tue, Dec 31, 2013 at 12:32 AM, Griffin Boyce <griffin at cryptolab.net>
> wrote:
>>...
>>   I prefer my shared hallucinations to be in the form of Lindens [1], ...
>
>
> i'll let you cypherpunks in on a secret financial tip:
>   the smart money banks in dogecoin: http://dogecoin.com/
>
>


-- 
Cari Machet
NYC 646-436-7795
carimachet at gmail.com
AIM carismachet
Skype carimachet - 646-652-6434
Syria +963-099 277 3243
Amman +962 077 636 9407
Berlin +49 152 11779219
Twitter: @carimachet <https://twitter.com/carimachet>

Ruh-roh, this is now necessary: This email is intended only for the
addressee(s) and may contain confidential information. If you are not the
intended recipient, you are hereby notified that any use of this
information, dissemination, distribution, or copying of this email without
permission is strictly prohibited.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4421 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/c4daecd4/attachment.txt>

From jamesdbell8 at yahoo.com  Tue Dec 31 12:41:21 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 12:41:21 -0800 (PST)
Subject: Jim Bell comes to Cypherpunks?
Message-ID: <1388522481.31937.YahooMailNeo@web141205.mail.bf1.yahoo.com>

    Since the issue was just raised about me needing a PGP key (presumably, for now, just for signing purposes), it occurred to me that the best way to get that key signed would be for me to attend a meeting of Cypherpunks.  Since many such meetings occur in the Bay Area (San Francisco and environs) I could come from Vancouver Washington (Just across the Columbia river from Portland) and attend an upcoming Cypherpunks meeting.  What I'd appreciate would be a local who could provide transportation (I don't do 'credit card' and they probably wouldn't rent a car to me if I did!), and possibly a place to stay for 2-3 days.  Does this sound like a plan?  I could bring my BOP (Bureau of Prisons) ID, smuggled out when I was released, and auction it off for bitcoins, to pay for my expenses. (It's sure to be a collector's item someday!)

          Jim Bell
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1293 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/628b5132/attachment.txt>

From s at ctrlc.hu  Tue Dec 31 04:42:59 2013
From: s at ctrlc.hu (stef)
Date: Tue, 31 Dec 2013 13:42:59 +0100
Subject: Replacing corporate search engines with anonymous/decentralized
 search
In-Reply-To: <1388305027.11664.55.camel@debian>
References: <1388305027.11664.55.camel@debian>
Message-ID: <20131231124259.GB7003@ctrlc.hu>

On Sun, Dec 29, 2013 at 12:17:07AM -0800, Jesse R. Taylor wrote:
> but I've seen very little focus on the need for development of
> alternatives to corporate search engines. 

[disregarding the corporate focus] i can warmly recommend https://searx.0x2a.tk

-- 
pgp: https://www.ctrlc.hu/~stef/stef.gpg
pgp fp: FD52 DABD 5224 7F9C 63C6  3C12 FC97 D29F CA05 57EF
otr fp: https://www.ctrlc.hu/~stef/otr.txt




From jya at pipeline.com  Tue Dec 31 12:10:34 2013
From: jya at pipeline.com (John Young)
Date: Tue, 31 Dec 2013 15:10:34 -0500
Subject: To Protect and Infect Slides
In-Reply-To: <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.g
 mail.com>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
Message-ID: <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>

30c3 slides from Jacob Appelbaum:

http://cryptome.org/2013/12/appelbaum-30c3.pdf (3.8MB)





From electromagnetize at gmail.com  Tue Dec 31 13:20:29 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 15:20:29 -0600
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <52C3257D.6000707@appelbaum.net>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
 <52C3257D.6000707@appelbaum.net>
Message-ID: <CADhsnxdNVWsgdys_jAqF6=_inBkCybC3rpFj_ESndbzixzMm9A@mail.gmail.com>

 a few observations related to the video presentation:

1) often hear issues about legitimacy of mass surveillance in relation to
'targeted surveillance' as delineator, whereby legitimate targeting is
afforded to actual threats to the state and its required security measures
that likely involves way more in the realm of reasoning and undocumented
information than people are aware of, to determine whether or not a threat
exists and if such measures are necessary in terms of state security.

thus, surveilling of individuals who are problematic (either as actual foes
- aka terrorists, dangerous criminals, spies - or those wrongly-categorized
though falling into this same catch-all category) yet where oversight or
high fidelity review may not exist and thus reasoning may be weak for who
is targeted along with those who are legitimate threats.

meaning: in the talk the group or category of 'Muslims' were mentioned as
surveillance targets, though perhaps not all of these, yet in relation to
profiling, it would suggest mass surveillance could exist in certain
communities moreso than in others. in that the individual scales into a
group target, the weighting of probability perhaps moving higher in certain
demographic characteristics shared as part of a threat model outline. so
too, activists against business interests and so on, depending upon how
privatized the surveillance model is, what it is being used for, how it is
leveraged for political agendas, etc.

and so oftentimes in the mainstream viewpoint it tends to be that the
targets that tend towards some fraction of 1% of the population are likely
legitimate targets (say, 0.00001%) so that, as an example, a US population
of 314 million people has around 3,139 actual threats that would justify
surveillance measures in terms of their violent activities that threaten to
undermine the state or pursue terrorist actions against the population
(unless false flag engineered, etc).

and here is my contention with this view, and how a category such as
'ethnicity' or 'religion' may indicate there are other potential dynamics
that legitimate mass surveillance, and so it may be a fallacy to uphold
this perspective, that only some fraction of 1% are justifiable for
targeted surveillance and not dragnets over the entire population--
because, what if instead the threat involves an invading force, an
occupation, where the opponent tends towards 30% to more than 50% or more,
so that it could be 150 million people and those they are related to that
require tracking and further analysis. and that this is the more likely
threat model, in certain scenarios, depending on how it is calculated. and
could also exist as a paradox, where 'both sides' use the same or similar
surveillance to track opponents, though with different ends such that the
NSA is not a monolithic ideological organization and could be involved in a
deception campaign whereby there is a 'sandbox' for a pretend-NSA operating
as if the NSA, inside the larger organization and this is the context for
issues of who is surveilled, how surveillance is occurring, state- and
world-level honey traps, bear traps, monster traps, and so on.

in plain sight i think there are conditions of a civil war at world scale
and this is the threat model, and there is rotten surveillance that is
driven by the corrupt state, and a surrogate or pretend-NSA at the helm,
itself corrupted yet also contained, and then another threat model that is
monitoring all of this activity via surveillance at the scale of 50% or
greater of the population, in great and intricate detail, that remains
legitimate. and so, a vast forward strategy yet that is invisible, and a
smaller corrupt forward strategy that will be made visible in its
corruption. (set(subset)) dynamics.

in that this complex approach maps to military strategy of the early into
late 20th century, including the aftermath of WWII and politics of Vietnam
war in cultural terms extended into the present, and in terms of
{superset}, millennia of strategic planning likewise, setting up a false
order in order to take it down in an open-source context of Armageddon.

2) it seems bizarre that NSA activities are confined to computer technology
and there is yet no mention of behavioral dimensions to hacking, including
neurological attacks using em tools and weaponry. in that psychologists,
neurologists, psychiatrists and others vital information to hacking people
who are targeted, to program or force into disrepair. for instance, certain
chemicals can enter into the body via food supply and then be triggered via
signals and electromagnetic fields, activating them via remote switch.
chemicals in food supply then like junk dna that allows such custom
targeting at a distance, say via hostile management of infrastructure,
beyond normal rules, boundaries. the realm of mindwarfare and psychological
war, information operations at the covert level _must be tied to this same
NSA infrastructure manipulation if existing and attacking populations, yet
why is it disregarded as part of this context, why is the very direct
connection between EM tech and EM human physiology disregarded a priori as
an attack vector and not dealt with in the human rights context it should
exist within by default, if made readily aware that such dynamics are
inherent- not anomaly - to this aggressive surveillance, goals of behavior
modification, etc.

3) this leads to the issue of how this technology is fielded. if it exists,
the quickest and most distribributed, efficient route for an eight-mile
distant attack would be the cellular tower infrastructure that already
exists. that would turn it from a manual operation with field agents on
site or locally, to an issue of remote administration of these tools and
their automation, such that any person (tending towards 50% of population
model, say) could be attacked, and that it is not a tiny fraction and
instead every single device that could be scaled to the highest threat
model as need be, and thus whatever tools exist to do this would need to
exist in a context of mass surveillance, not individual cases that are few
and far between, because if that is not the nature of the actual threat,
why would tools be restricted in their use to a less-than-necessary
deployment. and thus automated infrastructure deployment seems probable in
this regard.

4) in this way, so too, neurological weaponry and behavior modification
hacking tools would likely coexist in a similar context if deployed and in
use, much more serious than attacking inert tools and equipment. attacking
peoples - citizens - nervous systems and minds, driving people into ill
health or conditions of psychological/physiological torture via these same
technical means, perhaps a sub-branch of NSA or co-use via CIA special
programs or other military venture, yet hostile to citizenry, operating in
a faulty or infallible threat model, exploited by onesided politics of
hidden  dictatorship and so on. that level of realism does not yet exist
though certainly some measure of these hostile tools exist hidden within
the same infrastructure - deployed and leveraged by the corrupt overseers,
so when will Snowden or other documents enter into the neurological and
other health aspects of hacking, cracking, pwnage, etc. that is, invisible
death squads sitting like chess pieces on the city grid, awaiting orders to
attack via next hostile moves, &c.

ksais   ywios   wpswz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 7815 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/b03642f9/attachment.txt>

From jamesdbell8 at yahoo.com  Tue Dec 31 15:20:34 2013
From: jamesdbell8 at yahoo.com (Jim Bell)
Date: Tue, 31 Dec 2013 15:20:34 -0800 (PST)
Subject: Fw: Jacob Appelbaum in Germany
In-Reply-To: <1388531645.82822.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
 <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
 <52C34B3C.50903@echeque.com>
 <1388531645.82822.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <1388532034.64928.YahooMailNeo@web141204.mail.bf1.yahoo.com>

From: James A. Donald <jamesd at echeque.com>

To: cypherpunks at cpunks.org 
Sent: Tuesday, December 31, 2013 2:54 PM
Subject: Re: Jacob Appelbaum in Germany
 

"James A. Donald"


>> As to Swartz he
 didn't commit any real crime so he never was, or pretended
>> to be, 'above the law'.
>Accessing someone else's computers without permission to obtain the 
>information therein is trespass.  The powerful trespass against the less 
>powerful.  He had mistaken ideas about how powerful he was.

My understanding (from reading the Wikipedia article on Swartz an hour ago) was that he accessed "PACER" information.   (  http://www.pacer.gov/   )    The information in PACER (which I have used a few times before, for example to access the docket for fake, forged, fraudulent "appeal" case 99-30210) is simply Federal court case files.  (Dockets; filings).  This material is legally in the public domain:  It is not even copyrighted.  I don't know if Swartz did anything 'illegal' to get into the computer that had the information, but I doubt that.
   Incidentally, the charge for PACER documents is now $0.10 per page, but if you run up a charge of less than $15.00 in a calendar quarter, there is no charge.  (In other words, less than 150 pages downloaded are free)
      Jim Bell  
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 3567 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/0be5ad5a/attachment.txt>

From lists at silent1.net  Tue Dec 31 07:29:09 2013
From: lists at silent1.net (Silent1)
Date: Tue, 31 Dec 2013 15:29:09 -0000
Subject: Jacob Appelbaum in Germany
In-Reply-To: <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
Message-ID: <006601cf063d$0d4e9820$27ebc860$@net>

Ahh, Dogecoin, didn't an online wallet service of theirs get hacked last
week and completely cleaned out of hundreds of thousands of coins?

-----Original Message-----
From: cypherpunks [mailto:cypherpunks-bounces at cpunks.org] On Behalf Of
coderman
Sent: Tuesday, December 31, 2013 8:51 AM
To: Griffin Boyce
Cc: cpunks
Subject: Re: Jacob Appelbaum in Germany

On Tue, Dec 31, 2013 at 12:32 AM, Griffin Boyce <griffin at cryptolab.net>
wrote:
>...
>   I prefer my shared hallucinations to be in the form of Lindens [1], ...


i'll let you cypherpunks in on a secret financial tip:
  the smart money banks in dogecoin: http://dogecoin.com/




From l at odewijk.nl  Tue Dec 31 06:37:24 2013
From: l at odewijk.nl (=?UTF-8?Q?Lodewijk_andr=C3=A9_de_la_porte?=)
Date: Tue, 31 Dec 2013 15:37:24 +0100
Subject: Replacing corporate search engines with anonymous/decentralized
 search
In-Reply-To: <20131231124259.GB7003@ctrlc.hu>
References: <1388305027.11664.55.camel@debian> <20131231124259.GB7003@ctrlc.hu>
Message-ID: <CAHWD2rKUdr_PyvP82UMPNtYC2rbObjX3v-qD43h-27exizxrMw@mail.gmail.com>

I'd like to ask people to wonder what Search Engines really do for us.
Where is the catalog? Where is the cultivated list of good resources?

Do search engines provide the same level of guidance to its users that a
written overview can?

Why don't we create a distributed website catalog? It's harder, as
anti-spam is the core feature. But competing with Google seems rather
foolhardy at the moment.

Maybe the word catalog isn't right, catalogs are too static and not
discovery targeted at all.

Maybe a Yahoo! answers type of tagging/cataloging would work rather well.

Anyway: think about it guys! I'm sure there's a better way than "this
keyword is also in this page which links to other good pages"!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1088 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/72deae31/attachment.txt>

From electromagnetize at gmail.com  Tue Dec 31 13:42:21 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 15:42:21 -0600
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <52C3257D.6000707@appelbaum.net>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
 <52C3257D.6000707@appelbaum.net>
Message-ID: <CADhsnxeLBY0gafW=oh9c4eTN5KgnkLx6j7OJEsLV9XAeoV=SXA@mail.gmail.com>

// forgot to mention this...

5) another realization upon hearing the 30c3 talk of Jacob Appelbaum
was the 'earth firewall' then indicates that the NSA controls the internet,
and that it is not operating as a subset within it, and instead everything
that occurs is within its domain....

the earlier belief, even in context of Arpanet origins...


    ( "the Internet" (NSA activities) )


when instead, a more realistic scenario in terms of who controls the
technical infrastructure, aka the foundation of cyberspace...


     NSA (the internet)


this makes a world of difference, because then national networks and
technological development occur 'inside' the framework of NSA and it
essentially governs or manages production of equipment, backdoors
installed, and if corrupt, loss of law within that same context that can
and does served warped political goals, attacking political opponents,
dissidents, those against the ruling ideology. technology allowing this.


    NSA (the internet (countrycodes) )


in this way, a corrupt NSA with dictatorial agenda could have established
default control, and enact, develop, extend hidden political organization
via secret or overt manipulations that gain and secure, solidify power yet
which exist beyond law, 'external governance', even within the state itself


    NSA is god, essentially. having rooted earth and its inhabitants.

    // if technical jargon is correct for a non-programmer


   ...and yet does not observe external truth, adhere to or recognize
   shared laws of the state, the US constitution, and other agreements
   that bind the state to its people, in service, versus in exploitation.


in this way, state violence could be automated, mechanized against
populations that somehow believe the NSA is contained and not the
entity doing the containing. like there is an unrecognized role-reversal
by the corrupt entity in a power grab related to hidden, secret US coup


ywips  ispzn   wzqko
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2517 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/c05084fd/attachment.txt>

From electromagnetize at gmail.com  Tue Dec 31 13:59:47 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 15:59:47 -0600
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <52C3257D.6000707@appelbaum.net>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
 <52C3257D.6000707@appelbaum.net>
Message-ID: <CADhsnxfuqM_NAayr702C7AsgnX96cSu+D27=pvAqeaaGgAreTw@mail.gmail.com>

// someone has to be repetitious to provide proof-of-concept

it is my belief that 'context is everything' applies to the review
of these same issues and ideas, especially: location^3

consider issues of mass surveillance and mass deployment
of technical means and measures, for saturation potential so
that getting to the target is a non-issue, zero cost essentially
once installed (the role of infrastructure, resolving such issues
by providing a managed platform that readily automate tasks)


consider 'integrated surveillance' tools and capabilities in a
blackbag context. really think a fleet of a 100 tempest vans
exist in every city, or do the economics work against this as
a scalable approach and require instead cellular towers or
wi-fi antennas as a base for such activities to occur. and if
this were possible, would it not be integrated to N-degrees
of capability? consider electronic door locks in a context of
black bag jobs. what if a remote software command could
more easily unlock a car via cellular tower than a person,
and invisibly, (this prior to them driving you off the road in
autonomous or driverless vehicles, exciting future awaits)

so is psychological warfare and other information operations
by default assumed to involve teams on the ground or is it
potentially seamlessly integrated with existing infrastructure
and streamlined as another protocol layer that can or will be
deployed as or if needed, in terms of threat escalation and
what is legitimated in the given corrupt/illegal approach. if
assuming it involves people going from point A to B there
is little likelihood of these activities being deployed at the
scale of mass surveillance, and yet if infrastructure itself,
there is high likelihood or it is probable that they could be
made economical and exist as a potential to be used as
weapons against populations though may only target a
few individuals in the existing context, potentially, thus
0.00001% for more extreme and oppressive measures
may be accurate, in that what is hacked becomes the
person themselves, say via forced disease triggering or
whatnot, as part of this context of hostile surveillance
that in active and passive ways could still be deadly,
just slow drip, over time, versus out-in-the-open where
such attacks could be documented, proven to exist


ystsp  isozo  bxbvi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2756 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/1d42d68d/attachment.txt>

From electromagnetize at gmail.com  Tue Dec 31 14:22:04 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 16:22:04 -0600
Subject: Jacob Appelbaum in Germany
In-Reply-To: <52C33963.1000709@echeque.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
Message-ID: <CADhsnxfMCAHvBXzzcCp+FLTP7HygK+0tTt45a0TshFhYgOHEzA@mail.gmail.com>

James A. Donald <jamesd at echeque.com> wrote:

In practice, it is pretty obvious that most practitioners of civil
> disobedience believe they are above the law, that they usually *are* above
> the law, and that in particular Swartz believed he was above the law, and
> was shocked to find that he was not.
>
> There might be some sincere practitioners of civil disobedience, but
> Swartz was not, and the big heroes of the civil disobedience brigade,
> Ghandi and Thoreau, were not.
>


It seems in practice that there is a relation issue involved in
who judges and determines lawfulness in the shared situation.

oftentimes, the person who judges is actually 'the criminal' and
can "represent the state" and 'the people' though misleadingly,
subverting this relation. such that, a person who exists within
and operates in a criminal way, including relying upon lies as
a day to day framework, then convicts those who may break
one law or tell one lie in their lives or go beyond a boundary
out of principle and larger ethics that question the ruleset

and what happens or appears to is that all the power is with
those who cheat, lie, and steal within the state along with
their accomplices, and that these people 'are the state' that
then judges and determines the fate of otherwise law-abiding
citizens or those who seek to serve its best interests, not least
by enforcing its framework or utilizing its freedoms, testing the
parameters only to find they are not observed, are fiction only


(else, perhaps other more active strategies exist though are
correct in principle, in not adhering to laws that are inaccurate
or overbearing and allow the corruption its continuing power)

what this is to suggest is that the judge-convicted relation is:


    99.99% falsity + 0.01% truth   vs.  99.99% truth + error


(in that the evaluation occurs in a warped framework where
judgement is divorced from its own adherence to truth, via
the same corrupted constitution that allows for this relation)


    99% wrong  ---> judgement ---> 0.01% wrong


and yet this viewpoint (based on power) is itself based upon
LIES and deception, unaccountable to the same rules and
thus is beyond law. and thus it _must show falsity in another
yet never allow this to be accounted for in its own viewpoint
or actions-- which is how authoritarian, totalitarian, and the
secret dictatorship triumph in these conditions, because it
is beyond accountability, it is just about believing in higher
power that is based on lies and opinions, as it filters down
into culture via illiteracy, loss of education, social relations,
normalization of vice, oppression, exploitation, criminality


this is why the state must be abolished, because it has
become thoroughly rotten from the inside out due to the
outdated source code that provides loopholes to oppress
citizens and humans and the planet and animals worldwide
due to loss of truth, and making this lying 'legal' as a basis
for 'shared power' by who shares and is in on the lie, as this
then scales and becomes organization, authority, judgement

fjisw  sosip  wsznx
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 4012 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/c1aa1432/attachment.txt>

From electromagnetize at gmail.com  Tue Dec 31 14:34:23 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 16:34:23 -0600
Subject: Jacob Appelbaum in Germany
In-Reply-To: <52C33963.1000709@echeque.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
Message-ID: <CADhsnxecv1dFMGykQ-g=pXGDGsPkfZxFtMO5zS5iruita15ZGA@mail.gmail.com>

re:    99% wrong  ---> judgement ---> 0.01% wrong

this is also how 'masters of the drug war' convict
entire generations to subservience and obeyance via

mass surveillance, a threat of pending prosecution
by the very people who engineered the war of drugs
against their own populations to gain total power
via cutting off, neutralizing generations below them

and using a false and unreal ethical framework to
then judge and prosecute political enemies lists

thus solidifying the ruling dictatorship, OOSOOM


(i.e. drug lord determines drug user bad for society

if they challenge authority, use legal rights, etc)



On Tue, Dec 31, 2013 at 3:38 PM, James A. Donald <jamesd at echeque.com> wrote:

> In practice, it is pretty obvious that most practitioners of civil
> disobedience believe they are above the law, that they usually *are* above
> the law, and that in particular Swartz believed he was above the law, and
> was shocked to find that he was not.
>
> There might be some sincere practitioners of civil disobedience, but
> Swartz was not, and the big heroes of the civil disobedience brigade,
> Ghandi and Thoreau, were not.
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1582 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/fff95d90/attachment.txt>

From electromagnetize at gmail.com  Tue Dec 31 14:45:32 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 16:45:32 -0600
Subject: Jacob Appelbaum in Germany
In-Reply-To: <52C33963.1000709@echeque.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
Message-ID: <CADhsnxdatfxE2BKNGNMvfJGoj3HqtsPaD-vtj_g4UC7N+5-aTQ@mail.gmail.com>

// more realistic context of post-1960s worldview:

strange-read-reply function, to paraphrase:

In practice, it is pretty obvious that most practitioners of civil
> disobedience believe they are above the law, that they usually *are* above
> the law, and that in particular [users of illegal drugs: cocaine, meth,
> heroin, acid, ~pot; once alchohol] believed [they were] above the law, and
> [perhaps will be] shocked to find that [they are] not.
>
> There might be some sincere practitioners of civil disobedience,
> [including drug users and dealers], big heroes of the [counterculture and
> its ideological] brigade....


or:


> In practice, it is pretty obvious that most practitioners of civil
> disobedience believe they are above the law, that they usually *are* above
> the law, and that in particular [psychiatric prescribing of harmful pills:
> "anti-psychotics", "antidepressants" etc] believed [they were] above the
> law, and [perhaps will be] shocked to find that [they are] not.
>

> There might be some sincere practitioners of civil disobedience, but
> [psychiatrists] was not, and the big heroes of the [political takeover]
> brigade....
>


it is the problem of analysis: focus on the person who takes a gun
and shoots people, not on the pills they were prescribe, the failed
institutions surrounding them, etc. too simplistic, inaccurate model
does not distinguish symptoms from disease, allows it to continue

(lose accurate, empirical logical reasoning, no way to address this,
thus loss of language, no matter encrypted comms, this situation;
because it cannot be modeled or related to in realistic framework,
and thus short-circuits into power games and political engineering,
which is inherently violent and leads to those terms of resolution)

82729   02020  82802
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2603 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/6bece7f1/attachment.txt>

From carimachet at gmail.com  Tue Dec 31 08:03:48 2013
From: carimachet at gmail.com (Cari Machet)
Date: Tue, 31 Dec 2013 17:03:48 +0100
Subject: Jacob Appelbaum in Germany
In-Reply-To: <006601cf063d$0d4e9820$27ebc860$@net>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
Message-ID: <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>

dear sir

we are reaching out to MIT alumni to make a public call of outrage re
among other things the aaron swartz treatment by MIT would u b willing
to b included?

specifically we would b asking for shifts in functionality not just
complaining to the bricks

THANKS

On 12/31/13, Silent1 <lists at silent1.net> wrote:
> Ahh, Dogecoin, didn't an online wallet service of theirs get hacked last
> week and completely cleaned out of hundreds of thousands of coins?
>
> -----Original Message-----
> From: cypherpunks [mailto:cypherpunks-bounces at cpunks.org] On Behalf Of
> coderman
> Sent: Tuesday, December 31, 2013 8:51 AM
> To: Griffin Boyce
> Cc: cpunks
> Subject: Re: Jacob Appelbaum in Germany
>
> On Tue, Dec 31, 2013 at 12:32 AM, Griffin Boyce <griffin at cryptolab.net>
> wrote:
>>...
>>   I prefer my shared hallucinations to be in the form of Lindens [1], ...
>
>
> i'll let you cypherpunks in on a secret financial tip:
>   the smart money banks in dogecoin: http://dogecoin.com/
>
>


-- 
Cari Machet
NYC 646-436-7795
carimachet at gmail.com
AIM carismachet
Skype carimachet - 646-652-6434
Syria +963-099 277 3243
Amman +962 077 636 9407
Berlin +49 152 11779219
Twitter: @carimachet <https://twitter.com/carimachet>

Ruh-roh, this is now necessary: This email is intended only for the
addressee(s) and may contain confidential information. If you are not the
intended recipient, you are hereby notified that any use of this
information, dissemination, distribution, or copying of this email without
permission is strictly prohibited.




From electromagnetize at gmail.com  Tue Dec 31 15:06:00 2013
From: electromagnetize at gmail.com (brian carroll)
Date: Tue, 31 Dec 2013 17:06:00 -0600
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <E1Vy81w-0003h3-R2@elasmtp-dupuy.atl.sa.earthlink.net>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
 <52C3257D.6000707@appelbaum.net>
 <CADhsnxfuqM_NAayr702C7AsgnX96cSu+D27=pvAqeaaGgAreTw@mail.gmail.com>
 <E1Vy81w-0003h3-R2@elasmtp-dupuy.atl.sa.earthlink.net>
Message-ID: <CADhsnxcMFLuzm9oebT7z5ViQ=E25UPc=UhDZpVoS3r=0d7HtLQ@mail.gmail.com>

i was thinking about 'hidden powerline networking' as a threat
the other day. basically anything that could be plugged into a
socket with hidden one-way networking on chip, that would
be able to siphon network data or use as a sensor or bug &
send this data into a larger circuit, say apartment electrical
wires that could be picked up remotely as frequencies that
are outside ordinary spec, at another onsite location such
that a device simply is plugged into the same site to reveal
or tap into the data. i imagine this is completely TRIVIAL
to accomplish, especially due to no regulatory/enforcement
or consumer protections in a security or commercial context
as it aids surveillance goals, especially in political framework
of secret policing, informers, etc. spying by the populations.

such that anything with a cord potentially could feed such
data, if designed this way. speakers or router or monitor or
printer or clock or lights or blender or microwave, etc. and
that it could seem innocuous, yet have this capacity or this
'surveillance potential' (as in, potential energy vs. applied),
such that grassroots on-site monitoring could be aided and
abetted likewise by such technological compromise, this
in terms of intent and design or perhaps not revealed or
deployed though part of a COT readymade solution that
just requires smd circuitry add-ons to activate functionality

this could be a stupid-model, versus smart expert systems
or total monitoring solutions, the dust mote approach that
leads towards a *density* of surveillance means/measures

what is the square-footage of surveillance in your domain,
etc. how many bugs per cubic meter, what if it was not
one or two and instead, potentially dozens, this beyond
the computer itself, in the realm of what it is possible and
thus a question of where ubiquity may exist when fully
surveilled, to what degree is maximal different in kind
from minimal, such that the garage door opener and
the car and dishwasher and HDTV and phone and the
LED lights and remote-control car are monitoring you,
in addition to computers, cellphone, conversations.

(such as: is your router and neighbors wi-fi being used
as an attack vector, are you being imaged via through-
wall radar via wi-fi, for tracking and monitoring. or being
made ill via out of spec radiation boosting via wi-fi, etc)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 2914 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/ec5ad74e/attachment.txt>

From albill at openbuddha.com  Tue Dec 31 17:41:13 2013
From: albill at openbuddha.com (Al Billings)
Date: Tue, 31 Dec 2013 17:41:13 -0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388532034.64928.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
 <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
 <52C34B3C.50903@echeque.com>
 <1388531645.82822.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388532034.64928.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <0B37709E592245E5B5C6E3FBB0B96901@openbuddha.com>

No, the Pacer thing was previous. He was accessing JSTOR’s archive of (often publicly funded) scholastic research with a crawler of sorts. His main mistake seems to have been not rate limiting his requests, which caused so much traffic that he impinged server functionality and got noticed by the sysadmins for JSTOR, who then blocked access. He kept circumventing the blocks, drawing more attention, until they finally figured out who he was, where he’d put his laptop on their network, and arrested him.  

--  
Al Billings
http://www.openbuddha.com
http://makehacklearn.org


On Tuesday, December 31, 2013 at 3:20 PM, Jim Bell wrote:

> My understanding (from reading the Wikipedia article on Swartz an hour ago) was that he accessed "PACER" information.   ( http://www.pacer.gov/   )    The information in PACER (which I have used a few times before, for example to access the docket for fake, forged, fraudulent "appeal" case 99-30210) is simply Federal court case files.  (Dockets; filings).  This material is legally in the public domain:  It is not even copyrighted.  I don't know if Swartz did anything 'illegal' to get into the computer that had the information, but I doubt that.
>    Incidentally, the charge for PACER documents is now $0.10 per page, but if you run up a charge of less than $15.00 in a calendar quarter, there is no charge.  (In other words, less than 150 pages downloaded are free)
>       Jim Bell   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 5567 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/654f4ad5/attachment.txt>

From jya at pipeline.com  Tue Dec 31 14:43:58 2013
From: jya at pipeline.com (John Young)
Date: Tue, 31 Dec 2013 17:43:58 -0500
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <CADhsnxfuqM_NAayr702C7AsgnX96cSu+D27=pvAqeaaGgAreTw@mail.g
 mail.com>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
 <52C3257D.6000707@appelbaum.net>
 <CADhsnxfuqM_NAayr702C7AsgnX96cSu+D27=pvAqeaaGgAreTw@mail.gmail.com>
Message-ID: <E1Vy81w-0003h3-R2@elasmtp-dupuy.atl.sa.earthlink.net>

Brian Carroll rightly expands the discussion of pervasive targeting by
ubiquitous technology.

In architecture, for example, the increasing use of automation
for controlling building systems -- HVAC, electrical, plumbing,
security among others -- poses considerable vulnerabilities
beyond legacy analog controls. Many of the automated systems
are administered remotely over telephone, cable and
wireless networks. Others are controlled locally within
structures. Some are secured with encryption but many
are not. And few are TEMPEST-protected outside military
and governmental facilities.

We have found that few architects and building engineers are
knowledgeable about building automated systems nor the variety
of means to secure and protect them. They are customarily designed,
operated and maintained by specialty firms not traditional
building designers.

Moreover we have found that building management and
maintenance staff rely upon outside firms for advanced
technology, thus subjecting their facilties to unsupervised
interventions by outside personnel who may themselves
be sub-contractors, and sub-subs for each component
of automation.

In short, it is fairly easy to interdict and access building
automation systems for implanting devices, injecting
packets, tampering with OSes, siphoning networks,
temporarily suspending security, all the things recently
revealed in the 30c3 presentations.

Digital security and TSCM experts are familiar with many
of these vulnerabilities but there is a common practice
to specialize in services (often at client request) and
neglect comprehensive coverage. For example, to inspect
communications and security systems but not HVAC,
plumbing, electrical and automation systems which often
have far more inadvertent emitters and transceivers contained
in extensive components throughout a structure.

NSA TAO and the joint CIA-NSA Special Collection Service
are especially capable to expoit these gaps, and usually
send teams composed of experts in each building system
to determine a comprehensive attack on vulnerabilities,
and shrewdly, planting multiple and various decoys to
mislead counterspies.

A catalog of these full-scope operations would be quite
informative and perhaps diminish the effectiveness of
ruses and decoys, in particular the kind of solo operation
valorized in movies, books and TV.





From cryptography at patrickmylund.com  Tue Dec 31 15:05:58 2013
From: cryptography at patrickmylund.com (Patrick Mylund Nielsen)
Date: Tue, 31 Dec 2013 18:05:58 -0500
Subject: Jacob Appelbaum in Germany
In-Reply-To: <52C34B3C.50903@echeque.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
 <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
 <52C34B3C.50903@echeque.com>
Message-ID: <CAEw2jfyfsyxzhEKzoY8GYhTkVBF5DuQonpBzK=T6c+QHe5G6Ag@mail.gmail.com>

On Tue, Dec 31, 2013 at 5:54 PM, James A. Donald <jamesd at echeque.com> wrote:

>
> Just look at the smirk on Schwartz's face.  Obviously he never expected to
> be punished.  He committed suicide not because a year in a country club
> prison was terribly harsh punishment, but because it was revealed he was
> not above the law after all.
>
> If anyone in the world was prepared to suffer for his beliefs, that person
> was not Aaron Schwartz.
>
>
>  As to Swartz he didn't commit any real crime so he never was, or pretended
>> to be, 'above the law'.
>>
>
> Accessing someone else's computers without permission to obtain the
> information therein is trespass.  The powerful trespass against the less
> powerful.  He had mistaken ideas about how powerful he was.
>
>
Just so people on this list are aware, James is either trolling or really
hated Aaron for some reason. Earlier this year on the randombit crypto
mailing list, he stated that it was a good thing Aaron killed himself
seeing as he "needed killing."

http://lists.randombit.net/pipermail/cryptography/2013-March/003947.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 1816 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/4dff1be8/attachment.txt>

From joe_wang at yahoo.com  Tue Dec 31 02:51:34 2013
From: joe_wang at yahoo.com (Joe Wang)
Date: Tue, 31 Dec 2013 18:51:34 +0800
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <1388480287.82083.YahooMailNeo@web141205.mail.bf1.yahoo.com>
 <1388481578.52663.YahooMailNeo@web160704.mail.bf1.yahoo.com>
 <1388483175.14710.YahooMailNeo@web141204.mail.bf1.yahoo.com>
Message-ID: <E7641A0C-E2B0-4C4A-B7CF-7BAE00BB68AD@yahoo.com>

... I was just thinking about verification.  but no security is good security….  happy new years guys!

-Joe

On Dec 31, 2013, at 5:46 PM, Jim Bell <jamesdbell8 at yahoo.com> wrote:

> I currently do not have a PGP key.  This lack is not entirely due to laziness or ignorance.  I also don't know anybody locally who has a PGP key, so I can't enter into the 'web of trust'.  And having been so long disassociated with the CP list (and computers, too:  Having been stuck in prison or denied access to computers for most of 15 years), I don't even recall how to do it.  
> I have another reason to not 'do' PGP:  Particularly due to the (unexpected) arrival of this 'Sanjuro' person, I am well aware that there are probably more than a few Feds who are on ultra-high alert, and from their point of view they may think of me as being "Suspect #1".  If I go back and start using PGP again (even if only for signing things) I wonder what they will think.  At the moment I have little need for secrecy, so I choose to not do PGP.
> (Also, I am virtually assuming that everything on my computer can be, and probably is, being read by a few dozen spy organizations of technically-competent nations.  I use ordinary anti-virus programs, but I'm under no illusion that the NSA/CIA/GCHQ/TLA's of other nations can't devise a targeted bug that such software cannot find.)     If any of you are interested in helping me confirm or deny this paranoid suspicion, I would very much appreciate your assistance.)
>         Jim Bell
> 
> 
> From: Joe Wang <joe_wang at yahoo.com>
> To: Jim Bell <jamesdbell8 at yahoo.com>; coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
> Sent: Tuesday, December 31, 2013 1:19 AM
> Subject: Re: Jacob Appelbaum in Germany
> 
> hey Jim, that is too much information.  In this age less is more. :)  Can't you just use pgp to sign the email and whoever wants to verify can do so?
>  
> -Joe
> 
> From: Jim Bell <jamesdbell8 at yahoo.com>
> To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
> Sent: Tuesday, December 31, 2013 4:58 PM
> Subject: Fw: Jacob Appelbaum in Germany
> 
> Having had "*coin tipjar" explained to me, I have set up a BTC receive address.    "jim btc tipjar"      1AzNPQ1NhiD9uG1hU5g5Kdaccb88Dus2Bo
> 
>     Please note:  This address is the BTC tipjar for "Jim Bell", "James Dalton Bell", living at 7214 Corregidor, Vancouver WA 98664.  (phone and cell on request; As far as I know I'm listed.  I've never had an unlisted/unpublished phone number.).   Ham Call N7IJS (apparently I am the LAST "Tech-Plus" in existence; the FCC has refused to re-up my 2010 license application, but the laws say I can still do ham.)
> 
>     Note Also:  Having been on (and off) the Cypherpunks list since 1995 (mostly off, of course), I understand that a reasonable sense of caution will make many of you think, "Is this REALLY the 'Jim Bell' who wrote the AP essay, etc?"   For those who doubt, I have Skype set up to do a voice videophone.  There is a picture of me, in a green sweater, taken by Declan McCullagh about June 2000 on the web; I haven't changed a lot.  (I even have my green sweater, too!).  
>        Jim 
> 
> 
> Disclaimer:    I am not associated with 'Sanjuro's "Assassination Market" in any way.  I don't know who 'Sanjuro' is.  
> 
> 
> 
> 
> ----- Forwarded Message -----
> From: Jim Bell <jamesdbell8 at yahoo.com>
> To: coderman <coderman at gmail.com>; "cypherpunks at cpunks.org" <cypherpunks at cpunks.org>; "jacob at appelbaum.net" <jacob at appelbaum.net> 
> Sent: Monday, December 30, 2013 11:09 PM
> Subject: Re: Jacob Appelbaum in Germany
> 
> Sorry to appear so ignorant, but what is a "*coin tipjar"?
>         Jim Bell
> 
> From: coderman <coderman at gmail.com>
> To: Jim Bell <jamesdbell8 at yahoo.com>; Jacob Appelbaum <jacob at appelbaum.net> 
> Cc: "cypherpunks at cpunks.org" <cypherpunks at cpunks.org> 
> Sent: Monday, December 30, 2013 10:06 PM
> Subject: Re: Jacob Appelbaum in Germany
> 
> ...
> 
> hey Jim, (and Jake)
> 
> neither one of you appear to have a *coin tipjar yet...
> 
> why holding out? :)
> 
> 
> 
> best regards,
> 
> 
> 
> 
> 
> 
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: text/html
Size: 12112 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/1b2166cb/attachment.txt>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.cpunks.org/pipermail/testlist/attachments/20131231/1b2166cb/attachment.sig>

From juan.g71 at gmail.com  Tue Dec 31 13:52:35 2013
From: juan.g71 at gmail.com (Juan Garofalo)
Date: Tue, 31 Dec 2013 18:52:35 -0300
Subject: Jacob Appelbaum in Germany
In-Reply-To: <52C33963.1000709@echeque.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
Message-ID: <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>



--On Wednesday, January 01, 2014 7:38 AM +1000 "James A. Donald"
<jamesd at echeque.com> wrote:

> In practice, it is pretty obvious that most practitioners of civil
> disobedience believe they are above the law, that they usually *are*
> above the law, 


	The hell do you mean? If by 'the law' you mean natural rights, then the
people who think that they are above the law are all governemnt shitbags.
Every single member of every government is a criminal who thinks he is
'above the law'.

	Take a thorough sack of shit like thomas jefferson for instance. The guy
babbled about 'god given equal rights' while enslaving his fellows. If
that's not being 'above the law', I don't know what it is.


	As to Swartz he didn't commit any real crime so he never was, or pretended
to be, 'above the law'.


>and that in particular Swartz believed he was above the
> law, and was shocked to find that he was not.
> 
> There might be some sincere practitioners of civil disobedience,

	What is a sincere practitioner of civil disobedience? 


> but
> Swartz was not, and the big heroes of the civil disobedience brigade,
> Ghandi and Thoreau, were not.

> 
>  





From coderman at gmail.com  Tue Dec 31 19:00:10 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 19:00:10 -0800
Subject: Replacing corporate search engines with anonymous/decentralized
 search
In-Reply-To: <CAHWD2rKUdr_PyvP82UMPNtYC2rbObjX3v-qD43h-27exizxrMw@mail.gmail.com>
References: <1388305027.11664.55.camel@debian> <20131231124259.GB7003@ctrlc.hu>
 <CAHWD2rKUdr_PyvP82UMPNtYC2rbObjX3v-qD43h-27exizxrMw@mail.gmail.com>
Message-ID: <CAJVRA1TgoA778zQiEENWSidbzqecnPZZAziqYBOJ+qBffaBg1Q@mail.gmail.com>

On Tue, Dec 31, 2013 at 6:37 AM, Lodewijk andré de la porte
<l at odewijk.nl> wrote:
> I'd like to ask people to wonder what Search Engines really do for us. Where
> is the catalog? Where is the cultivated list of good resources?
>
> Do search engines provide the same level of guidance to its users that a
> written overview can?

what you want more than traditional search is resource discovery,
which includes recommendation and per-peer-perspective reputation.
this is an area where centralized search is incapable or untrustworthy
enough compared to fully decentralized options.

done centrally, that central trusted party would be privy to all your
inter-peer interactions.  in decentralized fashion this exposes only
limited information to each peer.  (central services usually paying
the cost of the infrastructure to analyze all to all interactions by
selling your private information to third parties, or delegating to
those who do...)



> Why don't we create a distributed website catalog? It's harder, as anti-spam
> is the core feature. But competing with Google seems rather foolhardy at the
> moment.

public web is a small slice of all that is of interest.  just put a
internet archive.org copy on a hidden Tahoe-LAFS and everyone gets a
copy of the public web for local querying. (better yet, make a PIR
LAFS ;)
... this would need a little coding *grin*




From hannes at stressinduktion.org  Tue Dec 31 10:04:52 2013
From: hannes at stressinduktion.org (Hannes Frederic Sowa)
Date: Tue, 31 Dec 2013 19:04:52 +0100
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
Message-ID: <20131231180452.GG31072@order.stressinduktion.org>

On Mon, Dec 30, 2013 at 10:19:21PM -0800, coderman wrote:
> On Mon, Dec 30, 2013 at 9:14 PM, Hannes Frederic Sowa
> <hannes at stressinduktion.org> wrote:
> > ...
> > Actually, somehow, I have a feeling of relief to see that major hardware
> > vendors don't seem to specifically work hand in hand with the NSA to
> > implement backdoors.
> 
> you're assuming this dump is exhaustive.  this is a very specifically
> themed/focused release of top end tactics and exploits (essentially
> weaponized platforms for targeted attacks). Jake says as much about
> what they're dropping, which while impressive, has still gone through
> the "best interest of public safety scrutinizing and censorship"
> rigmarole.
> 
> the indiscriminate, wholesale compromises are just getting started...
> these disclosures will have more impact: financially to the impacted
> vendors, effectively to IC as known vulnerable hardware and software
> is replaced, and to the public at large now exposed to even more
> essentially incomprehensible disclosures of vulnerability and
> compromise.

Sorry, no. It is absolutely important to be exhaustive and correct here.
Otherwise this whole thing could get out of hands and could get much worse.

There is a very big difference e.g. I (and a lot of other people too, I
guess) will react to vendors whose debug interfaces where just hijacked
by the NSA to install backdoors and where the vendors worked hand in
hand with the NSA to do so deliberately. And we cannot just assume that
because it looks like the easiest way to deal with this for us now and
blame others! Also, if this talk does not specifically say that those
vendors were working with the NSA, it would have been important to make
clear that we don't know and we cannot judge them by the facts presented
now. A lot of people, which seem to be really loud, often get this wrong.

If such FUD is spread against vendors, which in my opinion, do actually have a
valid interest in trying to stop those back doors, what do you think will a
lot of members of this community do? Cut off communication with those vendors,
place them on their I-will-never-work-there lists? And I say, that they will
still sell shitloads of trucks of hardware.

As a manager with no technical background on such an accused company,
what do you think will they do? Will they push things like secure boot
down our throats?  Will they make all the hardware much more closed
in fear this community does bad PR against them otherwise? Is that the
outcome we want?

On past Chaos Communication Congresses I really think those vendors would have
been cheered for having an open JTAG interface on a board. It seems days have
changed.

Until now I saw no facts that I distrust the major hardware vendors. I
already have a bad feeling with that but I need to be still reasonable
here, too. I cannot accuse those companies by the facts presented
until now. But essentially, it is important that this community does
work hand in hand with those vendors who are willing to and just got
exploited by the NSA to not bring them to the wrong conclusions and
make tampering with the hardware more hard but instead make open source
bios and firmwares that users can build and verify themselves. Make
documentation more open, show them people do care about that. If secure
boot or other means get established, show the users how they can use
that for *their* own good, build up *their* own crypto chains etc. Make
firmware source-code trackable via source repos, provides ways to rebuild
those code bit-by-bit. Provide repositories with changes, instead of
giant source code drops. Otherwise a new generation of NSA backdoors
will have it much easier to be really hidden in those hardware.

That may add additional costs for those companies. So show them it is worth
it!

> > I don't see that having a JTAG connector publicaly
> > accessible on a RAID controller as a hint for that. The other disclosures
> > also point to my conclusion that the NSA is mostly working on their
> > own. Of course, not all of Snowden's documents are released yet and
> > hence my feeling could be deceiving.
> 
> this is just an example of how, when the NSA pursues "all means and
> methods in parallel, without restraint" seemingly innocuous oversights
> are intentionally leveraged and discouraged from remediation for use
> in tailored access (black bag / targeted) attacks.

Yeah, the NSA and NSA only. Until now I have no facts that anyone but
the NSA does so deliberately.

> > I thought it could be worse.
> 
> it is worse.

Let's don't make it worse ourselfs. ;)

I don't want to see what the PR persons on those accused companies' twitter
feeds will have to go through now. I guess lots of overreaction is happening
now, which is not helpful at all.

Greetings,

  Hannes




From coderman at gmail.com  Tue Dec 31 19:08:10 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 19:08:10 -0800
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <20131231180452.GG31072@order.stressinduktion.org>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <20131231180452.GG31072@order.stressinduktion.org>
Message-ID: <CAJVRA1Rq9=xRkTBr2kAR=yx=557T535UK+1a5fzO+LYG6ED0dQ@mail.gmail.com>

On Tue, Dec 31, 2013 at 10:04 AM, Hannes Frederic Sowa
<hannes at stressinduktion.org> wrote:
> ...
> There is a very big difference e.g. I (and a lot of other people too, I
> guess) will react to vendors whose debug interfaces where just hijacked
> by the NSA to install backdoors and where the vendors worked hand in
> hand with the NSA to do so deliberately.

agreed.  we've got some years to wait for a definitive full picture.
 http://cryptome.org/2013/11/snowden-tally.htm - 932 pages (~1.6%) of
reported 58,000. NSA head claims 200,000 (~.40% of that released)


> If such FUD is spread against vendors, which in my opinion, do actually have a
> valid interest in trying to stop those back doors, what do you think will a
> lot of members of this community do?

vendor responses are fairly self evident.

bad: RSA
less-bad: Cisco
good/proactive: SilentCircle
etc,...   we could get into details of what makes a good vendor
response vs. one that is clearly weasel worded accountability
deflection, don't think this list is the place however.



> Until now I saw no facts that I distrust the major hardware vendors.

then you're not paying attention :)




> I don't want to see what the PR persons on those accused companies' twitter
> feeds will have to go through now. I guess lots of overreaction is happening
> now, which is not helpful at all.

corporate media sucks to more or less degree; i feel bad for anyone
who touches it.

glad it's not my problem!



best regards,




From jacob at appelbaum.net  Tue Dec 31 12:13:49 2013
From: jacob at appelbaum.net (Jacob Appelbaum)
Date: Tue, 31 Dec 2013 20:13:49 +0000
Subject: [cryptography] To Protect and Infect Slides
In-Reply-To: <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <E1Vy5db-0007lT-AS@elasmtp-scoter.atl.sa.earthlink.net>
 <CAOPE6PiQ-8HS=ZEPFUWy_ucrDpnYMfhKpU0A5ScpUJ=SDu9+Rw@mail.gmail.com>
Message-ID: <52C3257D.6000707@appelbaum.net>

Kevin W. Wall:
> On Tue, Dec 31, 2013 at 3:10 PM, John Young <jya at pipeline.com> wrote:
> 
>> 30c3 slides from Jacob Appelbaum:
>>
>> http://cryptome.org/2013/12/appelbaum-30c3.pdf (3.8MB)
>>
> 
> And you can find his actual prez here:
> <https://www.youtube.com/watch?v=b0w36GAyZIA>
> 
> Worth the hour, although I'm sure your blood
> pressure will go up a few points.
> 

I'm also happy to answer questions in discussion form about the content
of the talk and so on. I believe we've now released quite a lot of
useful information that is deeply in the public interest.

All the best,
Jacob




From coderman at gmail.com  Tue Dec 31 23:04:19 2013
From: coderman at gmail.com (coderman)
Date: Tue, 31 Dec 2013 23:04:19 -0800
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <20140101040205.GJ31072@order.stressinduktion.org>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <20131231180452.GG31072@order.stressinduktion.org>
 <CAJVRA1Rq9=xRkTBr2kAR=yx=557T535UK+1a5fzO+LYG6ED0dQ@mail.gmail.com>
 <20140101040205.GJ31072@order.stressinduktion.org>
Message-ID: <CAJVRA1TCRk4+5cK9o-9Q+7axHxN6heWUL7-wvgCEwKTK8U6BKg@mail.gmail.com>

On Tue, Dec 31, 2013 at 8:02 PM, Hannes Frederic Sowa
<hannes at stressinduktion.org> wrote:
>...
> Most of the implants are installed without we surely know if the vendors
> did know about that or am I missing something?

are you only considering this 30C3/catalog set of docs?

venally complicit to conveniently compromised to blissfully ignorant
compromise of hardware vendors goes back to CryptoAG and as recently
as the BULLRUN leaks.  a bit too long and complicated a thread for
this list, i think...




> I also don't count RSA as a hardware vendor in this case, as the
> backdoored RNG was included in their bSafe suite, which is purely
> software.

sure, just another example of in scope target for a "compromise all
the things" approach.

my point was to highlight their response as particularly deceptive and
inexcusable when observing how the various parties not only respond,
but act, in response to these leaks. (e.g. Google deploying crypto
over their internal fibers is positive action.  sitting silent or
deflecting criticism not confidence inspiring...)


best regards,




From hannes at stressinduktion.org  Tue Dec 31 20:02:05 2013
From: hannes at stressinduktion.org (Hannes Frederic Sowa)
Date: Wed, 1 Jan 2014 05:02:05 +0100
Subject: "To Protect and Infect" - the edges of privacy-invading technology
In-Reply-To: <CAJVRA1Rq9=xRkTBr2kAR=yx=557T535UK+1a5fzO+LYG6ED0dQ@mail.gmail.com>
References: <4dcbb04f7c2c485eb43d18e222b0f9a8@cryptolab.net>
 <20131231051456.GC25536@order.stressinduktion.org>
 <CAJVRA1QK_RBC=w_RW7pA8b4pbte47tqSPwbwhhOQtaA3otKvHw@mail.gmail.com>
 <20131231180452.GG31072@order.stressinduktion.org>
 <CAJVRA1Rq9=xRkTBr2kAR=yx=557T535UK+1a5fzO+LYG6ED0dQ@mail.gmail.com>
Message-ID: <20140101040205.GJ31072@order.stressinduktion.org>

On Tue, Dec 31, 2013 at 07:08:10PM -0800, coderman wrote:
> > Until now I saw no facts that I distrust the major hardware vendors.
> 
> then you're not paying attention :)

Most of the implants are installed without we surely know if the vendors
did know about that or am I missing something? Every implant needs a
dropper which installs it or access to the supply chain etc.

I also don't count RSA as a hardware vendor in this case, as the
backdoored RNG was included in their bSafe suite, which is purely
software.

Greetings,

  Hannes




From jamesd at echeque.com  Tue Dec 31 13:38:43 2013
From: jamesd at echeque.com (James A. Donald)
Date: Wed, 01 Jan 2014 07:38:43 +1000
Subject: Jacob Appelbaum in Germany
In-Reply-To: <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
Message-ID: <52C33963.1000709@echeque.com>

In practice, it is pretty obvious that most practitioners of civil 
disobedience believe they are above the law, that they usually *are* 
above the law, and that in particular Swartz believed he was above the 
law, and was shocked to find that he was not.

There might be some sincere practitioners of civil disobedience, but 
Swartz was not, and the big heroes of the civil disobedience brigade, 
Ghandi and Thoreau, were not.




From jamesd at echeque.com  Tue Dec 31 14:54:52 2013
From: jamesd at echeque.com (James A. Donald)
Date: Wed, 01 Jan 2014 08:54:52 +1000
Subject: Jacob Appelbaum in Germany
In-Reply-To: <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
 <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
Message-ID: <52C34B3C.50903@echeque.com>

"James A. Donald"
>> In practice, it is pretty obvious that most practitioners of civil
>> disobedience believe they are above the law, that they usually *are*
>> above the law,

On 2014-01-01 07:52, Juan Garofalo wrote:
> 	The hell do you mean?

I mean Bill Ayers, Ghandi, Thoreau. We have to obey their laws, but they 
do not have to obey their own laws.

Bill Ayers bombs the Pentagon, comes up smelling of roses.  You bomb the 
Pentagon, you will not.

Just look at the smirk on Schwartz's face.  Obviously he never expected 
to be punished.  He committed suicide not because a year in a country 
club prison was terribly harsh punishment, but because it was revealed 
he was not above the law after all.

If anyone in the world was prepared to suffer for his beliefs, that 
person was not Aaron Schwartz.

> As to Swartz he didn't commit any real crime so he never was, or pretended
> to be, 'above the law'.

Accessing someone else's computers without permission to obtain the 
information therein is trespass.  The powerful trespass against the less 
powerful.  He had mistaken ideas about how powerful he was.





From jamesd at echeque.com  Tue Dec 31 15:00:56 2013
From: jamesd at echeque.com (James A. Donald)
Date: Wed, 01 Jan 2014 09:00:56 +1000
Subject: Jacob Appelbaum in Germany
In-Reply-To: <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
References: <1388445314.96784.YahooMailNeo@web141204.mail.bf1.yahoo.com>
 <CAJVRA1TcRqWCyzUFmQtbbnofVdLM0GsDJ9-1+K2JyL03_jY23g@mail.gmail.com>
 <1388473744.13334.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <CAJVRA1QKRXzSC9tDnMyHZWhL5ZkUW5YWSoLMJoYwWTH4=H08Tw@mail.gmail.com>
 <d016e30c9be4578a3608f9f3c4f23609@cryptolab.net>
 <CAJVRA1QM+R7sGJMgZfBvNETJfnUBM45Q7x_DX2mHf5WJZX8VKg@mail.gmail.com>
 <006601cf063d$0d4e9820$27ebc860$@net>
 <CAGRDzQWqP+vz_iwyh5zoZDV+YQJA+SeqdZ8x30U=6bTL4cWZRA@mail.gmail.com>
 <1388519945.16721.YahooMailNeo@web141206.mail.bf1.yahoo.com>
 <52C33963.1000709@echeque.com>
 <2AEC19568BF00DB7A5FB03CA@F74D39FA044AA309EAEA14B9>
Message-ID: <52C34CA8.1020308@echeque.com>

On 2014-01-01 07:52, Juan Garofalo wrote:
> 	What is a sincere practitioner of civil disobedience?

Someone who expects to suffer for his beliefs, and is willing to do so 
is a sincere practitioner of civil disobedience.

Which Bill Ayers, Aaron Schwartz, Thoreau, Ghandi, Greenpeace, and the 
rest, transparently were not.

In practice, 99% of civil disobedience is Pussy Riot tearing down 
someone else's crucifix on someone else's property.  The message is "You 
have to obey our laws, but we do not have to obey even our own laws".