- cypherpunks@lists.ogf.org

Brazil hero homeless man dead after save a woman from gunman
by Felipe Felipe 08 Sep '15

08 Sep '15

https://www.youtube.com/watch?v=4Z3Q6y0dNAY http://www.unilad.co.uk/articles/homeless-man-dies-fighting-gunman-to-save-… Is brazilian security a joke? I'm from brazil and just wonder why things like that still are happening here. Is the cops from here a joke? Yes they are. I 've already been beaten by them without do anything just for walking in the streets, but when good people need them , they nothing do. They have had a chance to shot the man who had the woman, but besides they didn't anything they also let a citizen homeless get close of the killer, and they used to shot more than 30 times in the killer. The killer had been arrested more than 10 times, drug trafficking, attemped tp murder, aggression, resistance and many other things, he had got more than 20 years in jail and was in the streets free and armed. Is that our justice just do, let killers and bad people walk free among the citizens. Both men are homeless people and the killer was always been in walking with the gun in this place. That place that happend this is in the cathedral of Sé in São Paulo, too many foreign use to visit this place, because is the biggest church of Brazil and a historical place, that happend on last friday.

4 5

Re: Script Kiddie Killed in Drone Strike
by Rich Jones 08 Sep '15

08 Sep '15

Update to this: ISIS Twitter claiming this was the result of backdoors the ' Surespot <https://antipolygraph.org/blog/2015/06/07/developers-silence-raises-concern…>' "secure" messaging application. https://twitter.com/p_vanostaeyen/status/639165071072038913 On Wed, Aug 26, 2015 at 2:33 PM, Rich Jones <rich(a)openwatch.net> wrote: > > http://www.mirror.co.uk/news/world-news/junaid-hussain-dead-isis-computer-6… > https://en.wikipedia.org/wiki/Junaid_Hussain > > Apparently one of the TeaMp0isoN founders was just killed by a US drone > strike in Syria. Crazy times. > > According to the.. fairly questionable.. article linked above, he was #3 > on the US kill list, "behind only Jihadi John and ISIS leader Abu Bakr > al-Baghdadi"! Not bad for a guy most famous for SQL injections.. I wonder > who took his place on the list. > > R >

2 1

Hackers spent at least a year spying on Mozilla to discover Firefox security holes – and exploit them
by Georgi Guninski 08 Sep '15

08 Sep '15

Just to change the current boring discussion about fucked RFCs. http://www.theregister.co.uk/2015/09/04/mozilla_firefox_bugzilla_leak/ Hackers spent at least a year spying on Mozilla to discover Firefox security holes – and exploit them Bugzilla infiltrated, private vulns slurped since at least 2014 ==== comments: 2014 appears too high bound for me, might be wrong. Likely the mozilla u$a comrades caught the less skilled attackers, not those with r00t access (having in mind what a mess their code is).

10 17

Re: Hackers spent at least a year spying on Mozilla to discover Firefox security holes – and exploit them
by Ryan Carboni 07 Sep '15

07 Sep '15

No wonder firefox is seemingly more insecure lately. Only choices now are chrome or a text-only browser.

3 3

Can the NSA break 100000 bit RSA assuming they have O(n^6) or O(n^12) factoring algorithm?
by Georgi Guninski 07 Sep '15

07 Sep '15

In 2010 I generated two RSA keys (and certs) of size above 100000 bits: [Full-disclosure] nonsense fun: 100 000 bit rsa key http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0384.html The keys/certs: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0384/gir.… (the certs might have expired but this doesn't matter). The private keys are included too. According to my mail they were generated in "about 30 hours on 1 core" and I used state of the art primality checking "pfgw". n is the size of the modulus in bits. Assume the much loved NSA has factoring algorithms of complexity O(n^6) or O(n^12) running on classical computers. Can the NSA break n=100000 without using owning/torture? Some computations suggest NO, especially for the second: sage: k=100000 sage: RR(k^6).log(2) 99.6578428466209 sage: RR(k^12).log(2) 199.315685693242 Comments about quantum computer that can break them are welcome too.

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 03 Sep '15

03 Sep '15

On 9/2/15, Tim Sammut <tim(a)teamsammut.com> wrote: > ... > - Cisco IOS (and likely other platforms) will immediately export flows > if the cache fills to capacity. This will result in flows being > exported in less than inactive timeout,.. there is a second limit here, which is the netflow channel capacity / storage limit, if you introduce simulated flows at a rate beyond this capacity, you may become unobservable (via loss) resulting in failure to correlate. this is why i asked about logical injection via userspace of billions of flows per minute as a resistance measure. (e.g. scapy or other raw inject across a border with cooperating peer, if needed.) best regards,

2 1

Article by me on B. Brown transcript
by Douglas Lucas 03 Sep '15

03 Sep '15

Hi cypherpunks, I obtained the transcript to journalist Barrett Brown's second and final sentencing hearing and wrote an article on it. The lengthy article is all about the right to link. Here's the article: http://revolution-news.com/barrett-brown-vs-the-dept-of-justice-defining-th… Here's the transcript (PDF): http://douglaslucas.com/files/BBLOL_Transcript_January_Sentencing.pdf Thanks, Douglas

1 0

Re: [tor-talk] hardware recommendations
by grarpamp 01 Sep '15

01 Sep '15

On Sun, Aug 30, 2015 at 5:49 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > Intel has AMT and opaque microcode updates, other CPU vendors have > similar fun hardware features. > > Further reading regarding AMT from the FSF: > > https://www.fsf.org/blogs/community/active-management-technology Some Intel docs indicate that remote AMT requires their "LM" series lan controllers. The Intel programming guides and block diagrams indicate an ability to update (and perhaps by that to zero) the AMT and related firmware. Their general CPU microcode is signed. Didn't read far enough yet to tell the full scope of what is in their programming guides in these areas.

1 0

Parallel Polis Congress 2-4.10.2015 in Prague / Central Europe
by Pavol Luptak 31 Aug '15

31 Aug '15

Hello everybody, it would be my pleasure to invite you to cypherpunk conference Parallel Polis Congress 2015 that will take place during 2-4.10.2015 in Prague / Central Europe. Don't hesitate and join this great and unique event (more information below). Last year we had more than 1000 visitors from different countries, see the schedule http://www.paralelnipolis.cz/308/hackers-congress-paralelni-polis-2014-sche… Speakers already confirmed for this year - Lyn Ulbricht, Paul Rosenberg, !Mediengruppe Bitnik, Susanne Tarkowski Tempelhof, Julia Tourianski, Smuggler, Frank Braun, Slush, Stef, ..and much more. * Parallel Polis in theory Parallel Polis is a theoretical concept developed by Czech dissident Vaclav Benda (1942–1999) during the height of communist domination in Czechoslovakia in the 1970s. It was translated into English in 1978. Benda argues that in a repressed state, it is impossible to overturn corrupt social, economic and political institutions. Such efforts are futile. Instead, he suggests the creation of new "parallel institutions" that are more responsible to human needs. * Parallel Polis in practice We were impressed by the concept of Vaclav Benda’s Parallel Polis and Timothy C May’s Crypto Anarchistic Manifesto and Cyphernomicon. Embracing the current crypto-technologies we have realized a practical feasibility of these utopian theories and started a unique freedom think tank focused on the promotion of digital freedom, cryptocurrencies, anonymization networks and free markets. For this purpose we decided to rent a big 3-floor house (with almost 1000m2) in the center of Prague (Holešovice) - one floor dedicated to Bitcoin coffee-house, hub and hackerspace called Institute of Cryptoanarchy. :) * Founders of Parallel Polis Parallel polis is 100% state-free project, based on voluntary contributions only of our members and donors. Founding members are people from Czech contemporary-art group Ztohoven (http://ztohoven.com/) and group of cryptoanarchists from Czech and Slovak hackerspaces, see their recent projects Moral Reform (hack of Czech Parliament) http://juraj.bednar.sk/blog/2013/01/06/moral-reform-by-ztohoven-an-ultimate… and Citizen K ( http://artoftheprank.com/2010/06/19/ztohoven-art-collective-launch-citizen-… ) * Parallel Polis Congress and why we need you! Parallel Polis Congress is a 1-birthday party of a new era of our freedom. For such a unique event, we decided to invite all speakers whom we have loved and respected for a long time. * When & Where Parallel Polis Congress takes place in Parallel Polis building (Dělnická 43, Prague) during 2-4.10.2015. If you prefer to take public transport, take the tram number 1, 12, 14, 25, 53 or 54 to the tram station Dělnická. * Stay in touch http://hcpp.cz/ http://www.paralelnipolis.cz https://www.facebook.com/events/111132575904264/ https://twitter.com/Paralelni_polis -- ______________________________________________________________________________ [Parallel Polis - Bitcoin Coffee House, Hub and Cryptoanarchy hackerspace]

4 5

PROBLEM: Speech that Enables Speech: China Takes Aim at Its Coders
by Cari Machet 31 Aug '15

31 Aug '15

AUGUST 28, 2015 | BY DANNY O'BRIEN <https://www.eff.org/about/staff/danny-obrien-0> Speech that Enables Speech: China Takes Aim at Its Coders The maintainer of GoAgent, one of China's more popular censorship circumvention tools emptied out the project's main <https://github.com/phuslu/goagent/> source code repositories <https://github.com/goagent/goagent> on Tuesday. Phus Lu, the developer, renamed the repository’s description to “Everything that has a beginning has an end”. Phus Lu’s Twitter account's historywas also deleted, except for a single tweet <https://twitter.com/phuslu/status/636186971631677440> that linked to a Chinese translation of Alexander Solzhenitsyn’s “Live Not By Lies” <http://www.washingtonpost.com/wp-dyn/content/article/2008/08/04/AR200808040…>. That essay was originally published in 1974 on the day of the Russian dissident’s arrest for treason. We can guess what caused Phus Lu to erase over four years’ work on an extremely popular program from the brief comments of another Chinese anti-censorship programmer, Clowwindy. Clowwindy was the chief developer of ShadowSocks, another tool that circumvented the Great Firewall of China by creating an encrypted tunnel between a simple server and a portable client. Clowwindy also deleted his or her Github repositories last week. In a comment on the now empty Github archive Clowwindy wrote in English <https://en.greatfire.org/blog/2015/aug/chinese-developers-forced-delete-sof…> : Two days ago the police came to me and wanted me to stop working on this. Today they asked me to delete all the code from Github. I have no choice but to obey. https://www.eff.org/deeplinks/2015/08/speech-enables-speech-china-takes-aim… The author deleted that comment too shortly afterwards. Github, the host for both repositories, reported a DDoS attack on the days between these two incidents. While Github has not commented on the source of the current attack, the evidence strongly suggests <https://citizenlab.org/2015/04/chinas-great-cannon/> that a previous DDoS against Github in March was conducted by the Chinese government <https://www.eff.org/deeplinks/2015/04/china-uses-unencrypted-websites-to-hi…> to pressure the company to remove the repositories of two other anti-censorship programs. The Chinese government’s control of the Internet passes through regular waves of enhanced repression, often tied to a significant political event or protest. Many commentators have connected a current wave of media and Internet crackdowns <http://chinadigitaltimes.net/2015/08/beijing-shuts-commemoration-parade-reh…> to a forthcoming military parade commemorating World War II in Beijing on September 3. But even as a peak moment in a temporary spate of repression, the intimidation of GoAgent and ShadowSock’s creators represents a continuing escalation by the authorities against technologists. Chinese law has long forbidden the selling of telecommunication services that bypass the Great Firewall of China, as well as the creation or distribution of “harmful information”. Until recently, however, the authorities have not targeted the authors of non-commercial circumvention software, nor its users. Human Rights in China <http://www.hrichina.org/en>, a Chinese rights advocacy and research organization, told EFF that, based on its preliminary review, VPNs and circumvention software is not specifically prohibited under Chinese law. While the state interferes with people's ability to use such software, it has not outlawed the software itself. In November, Phus Lu wrote a public declaration to clarify <http://www.chinagfw.org/2014/11/goagent.html>this <http://www.chinagfw.org/2014/11/goagent.html>p <http://www.chinagfw.org/2014/11/goagent.html>oint. In the statement, he stated that he has received no money to develop GoAgent, provided no circumvention service, nor asserted any political view. Phus Lu’s caution at that time was prompted by the police questioning of another technologist, Xu Dong, a supporter of the Hong Kong opposition Umbrella Movement who was detained in the same month for “picking quarrels and creating disturbances” <http://chinachange.org/2014/11/12/young-it-professional-detained-for-develo…>. According to the Washington-based blog China Change, Xu Dong, who goes by the nym Onionhacker <https://twitter.com/onionhacker> online, had also been working on censorship circumvention code. During his detention he was told by the police that he had committed “crimes of developing software to help Chinese Internet users scale the Great Fire Wall of China.” Even if it's unclear what law Xu Dong had broken, if any, in November, the legal and political climate has grown even more aggressively anti-Internet since then. A new National Security Law <http://chinalawtranslate.com/2015nsl/?lang=en> came into effect on July 1 , which provides the authorities with a wide remit to oversee “internet information technology produces and services” that impact national security (Art. 59), as well as maintain “network sovereignty” <https://en.wikipedia.org/wiki/Network_Sovereignty> (Art. 25). It seems that is already being interpreted to include the creators of circumvention software. A sweeping bill on cyber-security <http://chinalawtranslate.com/cybersecuritydraft/?lang=en> is also in the works. The targeting of software developers by China is a new and worrying trend, but one that we’re seeing occur around the world. Authorities everywhere are realising that one way to sabotage free expression is to intimidate those who build the tools that enable that speech. Technologists like Phus Lu, Clowwindy and Xu Dong are now facing the same political scrutiny and intimidation in authoritarian regimes as independent writers, publishers, poets or journalists did in Solzhenitsyn’s time. Code is speech <https://www.eff.org/deeplinks/2015/04/remembering-case-established-code-spe…>: and using police intimidation to compel these creators to delete their code repositories is as serious a violation of human rights law as compelling a writer to burn his or her own books. It’s also as ultimately futile: while the Chinese authorities have chosen to target and disrupt two centralised stores of code, thousand of forked copies of the same software exist—both on other accounts on Github and in private copies around the Net. ShadowSocks and GoAgent represent hours of creative work for their authors, but the principle behind them is reproducible by many other coders. The Great Firewall may be growing more sophisticated in detecting and blocking new circumvention systems, but even as it does so, so new code blossoms. Meanwhile the intimidation of programmers remains a violation of the human rights of the coder—and a blow to the rights of everyone who relies on their creativity to exercise their own rights. .O. ..O OOO -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

1 0