- cypherpunks@lists.ogf.org

Bitcoin Warns Of State Attack In Binaries
by grarpamp 18 Aug '16

18 Aug '16

https://bitcoin.org/en/alert/2016-08-17-binary-safety 0.13.0 Binary Safety Warning 17 August 2016 Summary Bitcoin.org has reason to suspect that the binaries for the upcoming Bitcoin Core release will likely be targeted by state sponsored attackers. As a website, Bitcoin.org does not have the necessary technical resources to guarantee that we can defend ourselves from attackers of this calibre. We ask the Bitcoin community, and in particular the Chinese Bitcoin community to be extra vigilant when downloading binaries from our website. In such a situation, not being careful before you download binaries could cause you to lose all your coins. This malicious software might also cause your computer to participate in attacks against the Bitcoin network. We believe Chinese services such as pools and exchanges are most at risk here due to the origin of the attackers. Mitigation The hashes of Bitcoin Core binaries are cryptographically signed with this key. We strongly recommend that you download that key, which should have a fingerprint of 01EA5486DE18A882D4C2684590C8019E36C2E964. You should securely verify the signature and hashes before running any Bitcoin Core binaries. This is the safest and most secure way of being confident that the binaries you’re running are the same ones created by the Core Developers.

3 3

US election: both candidates are shit, system broken
by grarpamp 18 Aug '16

18 Aug '16

https://contraspin.co.nz/just-as-intended-the-u-s-election-is-tearing-us-to… Just As Intended: The U.S. Election Is Tearing Us To Shreds July 29, 2016 The only credible narrative about the US election is that both the main candidates are shit and the system is fundamentally broken. The third-party candidate, while enjoying organic growth in public support, is largely blacklisted by media and in the last election cycle was handcuffed to a chair for a prolonged period of time in order to prevent her from participating in the Presidential debates at all. In the backwards Orwellian nightmare we live in, exercising common sense or stating things as they quite plainly are and thus expressing views that oppose the monied and complicit status quo, is deemed a ‘radical’ and untenable position. Radical because too few have the proverbial balls to openly speak their mind or own the full extent of their true opinions in public, making those of us who do a rarity. Untenable because doing so makes you a target for relentless persecution or worse; a deterrent which is highly effective against those who treasure their public perception or persona, possessions, property, prosperity or (perceived) privacy above the need to appease their conscience by calling a spade a spade, honouring their humanity and openly advocating for the sociopolitical evolution we so desperately need. It was only a few years ago that millions of people were emboldened to speak up and demand radical (read: common sense) change. The relative speed with which they were largely subdued and corralled back into the political mainstream is frankly shocking and testament to the lethal efficiency of the systems of social control that surround us. Even Occupy Has Forgotten What Occupy Is About “No true democracy is obtainable when the process is determined by economic power.” – The Occupy Wall Street General Assembly wikileaks, etc...

2 2

TOR Project: Still coming unwrapped
by Steve Kinney 18 Aug '16

18 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Holy F Society, the TOR Project just came unwrapped. MORE. This essay keeps getting more outrageous, without losing credibility, until it turns a corner that "network security" people could easily attribute to hostile tradecraft. https://shiromarieke.github.io/tor -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXtUn5AAoJEECU6c5XzmuqHbQH/182mmOyXQsN6MigrmS4WhI4 xxVoNJoXwt1DBctCMC1eMq1o/nCCbicIeXwMMztzdmKQ9GReWzXrTW8hNjy7R4rR +JpUarD4xw5wRwllg4RD4QsBuu+RJp1c/Tyo+GZX49TmYeYk80Chgnfu3zoH2+nw SCftTWIZdlheUbY4GYnHUVWOkJaASvPz/ibZIRs5J6rIx4FPkqiuCckRkILJ7FXs ZzmepzzPY7cAnuW2Zm+kdkkACGnMUfYTdp4vM3pXLu8b4zfOpeRe5JxPVoapOF3P kDrJbDCyHnIDCsYOAeg1pPg3dlQAktN/FBqzQTS3UbaBq+NUJ47o1XvmyzGmZIs= =e8hU -----END PGP SIGNATURE-----

3 3

Riffle: an efficient communication system with strong anonymity
by grarpamp 17 Aug '16

17 Aug '16

http://news.mit.edu/2016/stay-anonymous-online-0711 https://dspace.mit.edu/handle/1721.1/99859 https://people.csail.mit.edu/devadas/pubs/riffle.pdf https://dspace.mit.edu/bitstream/handle/1721.1/99859/927718269-MIT.pdf

9 14

Is it fun owning augmented reality? Internet of Things?
by Georgi Guninski 17 Aug '16

17 Aug '16

Is it fun owning augmented reality? Or the Internet of Things? Any 'real reality' damages? http://www.ibtimes.co.uk/pokemon-go-security-flaw-enables-hacker-take-over-… Pokemon Go security flaw enables hacker to take over gyms in London and New York using eggs

1 0

Hedge fund manager profited from death arbitrage.
by jim bell 17 Aug '16

17 Aug '16

https://www.bloomberg.com/view/articles/2016-08-16/hedge-fund-manager-profi… "A vital function of the financial system is to shift risk, but that is mostly a euphemism. Finance can't make risks go away, or even really move them all that much. When the financial system shifts the risk of X happening from Y to Z, all that means is that Z gives Y money if X happens. If X was going to happen to Y, it's still going to happen to Y. But now Y gets money. Death is a central fact of human existence, the fundamental datum that gives meaning to life, but it is also a risk -- you never know when it will happen! -- and so the financial industry has figured out ways to shift it. Not in any supernatural sense, I mean, but in the regular financial-industry sense: by giving people money when death happens to them. One cannot know for certain how much of a consolation that is.""Another vital function of the financial system is to brutally punish the mispricing of risk through arbitrage. Actually I don't really know how vital that one is, but people are pretty into it. If someone under- or overestimates a risk, someone else will find a way to make them pay for it. That's how markets, even the market for death, stay efficient.""The normal way to shift the risk of death is life insurance -- you die, the insurance company gives you money -- but there are other, more esoteric versions, and they are more susceptible to arbitrage.One version involves "medium and long-term bonds and certificates of deposit ('CDs') that contain 'survivor options' or 'death puts.'" Schematically, the idea is that a financial institution issues a bond that pays back $100 when it matures in 2040 or whatever. But if the buyer of the bond dies, he gets his $100 back immediately, instead of having to wait until 2040. He's still dead, though."[end of partial quote] AP ('Assassination Politics'; https://cryptome.org/ap.htm ) can be considered to be 'death arbitrage' with a few key differences: The person who will die isn't part of the agreement, and doesn't profit when the initial deal is struck, nor later. Jim Bell

4 5

Weed, USPS, Tor... cypherpunk [was: Tor Browser]
by grarpamp 17 Aug '16

17 Aug '16

On 8/16/16, John Newman <jnn(a)synfin.org> wrote: > Awful lot of dope makes its way through USPS, with TOR as the medium for > setting up delivery, every day all day... Just log in to alphabay and browse > around ... ;) > > But, who knows how long they'll last, there might be sealed indictments > already... Great thing is... this is all testing a whole lot of new ground. >From anonymous overlay networks, delivery / drop models, comms tools, law enforcement, crypto, law itself, politics, leaks, hacking the IoT, privacy, etc... And it's getting faster, you only have to wait a few years to get a rough early status of each new iteration. Overall, it's exactly what should happen, and it's been a long time coming. PGP, 2600, and mixmaster were just some of the first forays, There's so much more to come, and to be done... be it for the world, or even just the peace pipe at 4:20.

2 1

Fwd: [liberationtech] Tor Browser 6.0.4 is ready for testing
by Cecilia Tanaka 17 Aug '16

17 Aug '16

Uff... Some months ago, I would be happy. Now, it means nothing... :(( ---------- Forwarded message ---------- From: "Yosem Companys" <companys(a)stanford.edu> Date: Aug 15, 2016 12:10 PM Subject: [liberationtech] Tor Browser 6.0.4 is ready for testing To: "Liberation Technologies" <liberationtech(a)lists.stanford.edu> Cc: "Georg Koppen" <gk(a)torproject.org> From: Georg Koppen <gk(a)torproject.org> Hi all, We are pleased to accounce that Tor Browser 6.0.4 is ready for testing. Bundles can be found on: https://people.torproject.org/~boklm/builds/6.0.4-build2/ This release finally brings Tor Browser users the latest Tor stable, 0.2.8.6, and avoids pinging Mozilla servers for system extensions. The latter was responsible for users getting an extension into their Tor Browser that resulted in annoying and confusing "Your Firefox is out of date" notifications on start-up (bug 19890). Thanks to Mozilla engineers who fixed that issue as fast as possible on their side: the extension is not shipped to Tor Browser users anymore if they ping Mozilla's server. Users that are on the alpha channel or are using the hardened Tor Browser were not affected. The same goes for Tails users as far as we know. The full changelog since Tor Browser 6.0.3 is: Tor Browser 6.0.4 -- August 16 * All Platforms * Update Tor to 0.2.8.6 * Update NoScript to 2.9.0.14 * Bug 19890: Disable installation of system addons Georg -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/ mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

6 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

US drug policy -> maintains the class divide
by Zenaan Harkness 16 Aug '16

16 Aug '16

>From a comment on slashdot - I'm not American, but this sounds quite plausible to me: http://news.slashdot.org/story/15/11/27/1343243/lsd-microdosing-gaining-pop… " If you're a $100k/yr engineer (Score:4, Insightful) by rsilvergun (571051) on Friday November 27, 2015 @10:52AM (#51013395) such things don't apply. In America we have a multi-tiered justice system. It's pretty well documented. Wealthy and educated people get treatment programs, while poor (and let's face it, black) people get jail. It's because what we're really using our drug policy for is to keep the poors in check. Think of it this way. If your poor chances are you or one of your friends is using drugs to cope with poverty. Now, our drug laws, in particular our asset forfeiture laws are basically guilt by association. Combine that with juries that are inherently conservative (since you generally have to be well off to be able to afford to server on a jury for any length of time). So when poor people show up in wealthy neighborhoods they not only stick out like a swore thumb, but odds are good the cops can bust them for the drugs at least one of them is carrying. This keeps poor people out of wealthy school districts and parks, and lets the wealthy enjoy their (much, much better) public services. Basically, our drug policy is central to maintaining our class divide... "

3 3