- cypherpunks@lists.ogf.org

Augur: Blockchain-based Internet prediction market.
by jim bell 26 Aug '15

26 Aug '15

http://reason.com/blog/2015/08/11/augur-gambling-prediction-ethereum Augur May Become the Greatest Gambling Platform in History. Is There Anything the Government Can Do to Stop It? A blockchain-based prediction market that won’t be controlled or managed by anyone. Jim Epstein Aug. 11, 2015 12:36 pm An online gambling platform could do to the neighborhood bookie what electric refrigerators did to the ice delivery man. Coming this fall, Augur will allow participants to wager money on any future event of their choosing. Software will set the odds, collect the bets, and disperse the winnings. The price alone should give Nevada sportsbook operators pause; an estimated one percent of every pot will go to keep the system running. The average vig today is about 10 times that. Augur isn't a full-fledged casino. You can't play roulette or poker, and running lotto on the platform would be tricky. But it'll be great for sports betting. Here’s what’s truly novel about Augur: It won’t be controlled by any person or entity, nor will it operate off of any one computer network. All the money in the system will be in Bitcoin, or other types of peer-to-peer cryptocurrency, so no credit card companies or banks need to be involved. If the system runs afoul of regulators—and if it’s successful, it most certainly will—they'll find that there's no company to sue, no computer hardware to pull out of the wall, and no CEO to lockup in a cage.This is new legal territory. If Augur catches on as a tool for betting on everything from basketball games to stock prices, is there anything the government can do to stop it? Augur is a decentralized peer-to-peer marketplace, a new kind of entity made possible by recent breakthroughs in computer science. The purpose of these platforms is to facilitate the exchange of goods and services among perfect strangers on a platform that nobody administers or controls. Augur’s software will run on what’s known as a “blockchain"—a concept introduced in 2008 with the invention of Bitcoin—that's essentially a shared database for executing trades that's powered and maintained by its users. Bitcoin’s blockchain was designed as a banking ledger of sorts—kind of like a distributed Microsoft Excel file—but Augur will utilize a groundbreaking new project called Ethereum that expands on this concept. Ethereum allows Augur's entire system to live on the blockchain. That means the software and processing power that makes Augur function will be distributed among hundreds or thousands of computers. Destroying Augur would involve unplugging the computers of everyone in the world participating in the Ethereum blockchain. If Augur is destined to become the cypherpunks answer to gambling prohibition—the betting man’s version of the online drug market Silk Road if you will—you'd never know it from talking with its developers. They work for a San Francisco-based nonprofit, attend conferences, have legal representation, and talk openly about what they’re up to with reporters. Augur even commissionedone of those cheesy motion graphics promotional videos favored by new tech startups. About half of the roughly $600,000 raised by Augur's development team comes from Joe Costello, the successful tech entrepreneur who was once Steve Jobs' top pick to become the CEO of Apple. Joey Krug, a twenty-year-old Pomona college dropout and Augur's lead developer, never uses the world “gambling" to describe his venture. He and his team of five employees call Augur a “prediction market,” a term that emphasizes the information generated when a bunch of people have a financial incentive to feed their expertise into a sophisticated algorithm. With Augur, as bettors move money in and out of the pot, the odds adjust. This yields publicly available statistics that should carry weight because they're derived from the opinions of a crowd of people with a stake in the results. InTrade, for example, the best-known prediction market until federal regulators forced it to stop serving U.S. customers in 2012, beat the pollsters and pundits by foreseeing the outcome of the 2008 presidential elections in 48 out of 50 states. Augur’s developers hope that their platform will make it possible to do a Google search to look up the likelihood of some future event. This could usher in a better world, with more informed policy decisions and less malinvestment. But Augur also serves the less high-minded—though no less noble—purpose of providing cost savings and convenience to gamblers. Restrictions on gambling serve to protect government revenue at the betting man's expense. State-sanctioned casino operators pay high taxes, and state-run lotteries fleece their customers. But there's no logical or moral case for government restrictions on gambling, since no third party is harmed when consenting adults wager money on the future. Augur actually has the potential to make the world safer by taking away market share in the gambling industry from criminals. And yet sports betting is illegal in most states, and prediction markets are tightly regulated by the Commodity Futures Trading Commission (CTFC). The agency sued Ireland-based InTrade in 2012 to prevent it from accepting bets from U.S. customers. (The company folded shortly after.) In 2013, the CFTC and the Securities and Exchange Commission (SEC) jointly sued the prediction market Banc de Binary for allowing U.S. customers to make bets on commodity prices. The CFTC has approved other prediction markets, such as the New Zealand-based PredictIt, but only after it agreed to abide by the agency's restrictions. Krug says the Augur team is planning to meet with CFTC staff go over how their system works before it’s launched, but says he's not overly concerned. “Our friends in Washington, D.C. say the CFTC will probably just dismiss Augur and say it’s not a big deal,” Krug told me in a phone interview. That doesn’t sound like much of a legal strategy, but how do you have a legal strategy when you're building something unlike anything that's ever existed? Federal anti-gambling laws, such as the 2006 Unlawful Internet Gambling Enforcement Act, target the companies that facilitate online betting— website operators, credit card companies, banks—not individual gamblers. Augur’s biggest legal vulnerability is the community of human “reporters” who are needed to settle bets on the platform, says Cardozo Law School's Aaron Wright, who is writing a book about the legal implications of blockchain technology. Let’s say a group of people wager money on Augur over the outcome of a boxing match. Once the bout is over, human participants (who receive a portion of the trading fees as compensation) must report the outcome to the system before Augur’s software will disperse the money to the winners. "There’s at least an argument that the people doing that reporting are aiding or abetting unlicensed options and could be prosecuted," says Wright. But Augur doesn't collect personal information on any of its users, so identifying these people could be difficult. And Augur is a borderless technology, so U.S. gamblers could simply rely on foreigners to report on the outcomes of their bets. One attorney I spoke with suggested that the team that’s building Augur could be brought up on charges for aiding and abetting a criminal conspiracy. Nate Cardozo, a staff attorney with the Electronic Frontier Foundation, thinks that's far-fetched but says he can't rule it out. Cardozo emphasizes that writing open source software doesn’t necessarily protect the team from prosecution. “We’ve taken the steps that we need to take in order to bracket the individual's risk and the organization’s risk,” says Augur’s attorney, Marco Santori, who declined to comment further on exactly what those steps might entail. Even if Krug and his colleagues were to face criminal prosecution, the technology would live on. After Augur is born into the world, the development team could release a software update that would cripple the system. But in that case, Augur's users could band together to block any changes to the underlying code, or another developer could copy the open source code and simply re-launch the platform. The big question with Augur—and with blockchain platforms more generally—is whether they can outrun our regulatory state long enough to grow so large and popular that they're truly unstoppable. My money’s on Augur in that race. For more on the promises and pitfalls of decentralized peer-to-peer marketplaces, read my recentReason magazine feature story on the topic.

2 1

Your paper on criminal contracts
by jim bell 25 Aug '15

25 Aug '15

Dear Professors Juels (http://www.arijuels.com/) and Shi (runting(a)gmail.com) and Ahmed Kosba akosba(a)cs.umd.edu : I've found a reference to your recent paper, http://www.initc3.org/publications.html. "The Ring of Gyges: Using Smart Contracts for Crime." Perhaps you are not aware, but 20 years ago (1995-6) I wrote an essay on a very similar subject. I called it "Assassination Politics". cryptome.org/ap.htm . Jim Bell

1 1

cute little cypher (i hate that other word) black swans
by Cari Machet 25 Aug '15

25 Aug '15

*Black Swans in a Cyber Forest: ‘FARness’ Needed In Future Information Technology Acquisition* http://smallwarsjournal.com/jrnl/art/black-swans-in-a-cyber-forest-%E2%80%9… Former Secretary of Defense Robert Gates stated, "Our record of predicting where we will use military force since Vietnam is perfect–we have never once gotten it right. . . We need to have in mind the greatest possible flexibility and versatility for the broadest range of conflict."[1] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> U.S. joint operations rely on consistent access to the cyber domain. It is in the complexity of the cyber world, and our new found reliance on it, that cyber black swan events are most dangerous to our security. The cyber domain is a 'forest' dense with complications and operational implications. Cyber black swan events will happen; we must prepare to deal with them. As the United States enters a reality where efficiency may trump effectiveness, it must be careful not to make cyber infrastructure decisions today that remove flexibility, adaptiveness, and robustness from the U.S. military in the future. The Department of Defense (DoD) is looking at maintaining and improving its cyber domain access with limited funds. The U.S. Navy, for example, began reducing the number of data-centers it operates, taking advantage of virtualization or "cloud-computing" technology.[2] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> Virtualization allows one server to service many customers and the “cloud” is the networked data center's servers storing and providing access to data from many locations. These new technologies increase speed and the efficiency of the operating system by distributing and utilizing processing power across the network.[3] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> ,[4] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> The Navy may be underestimating the need for flexibility, adaptiveness, and robustness (FAR) in its cyber infrastructure. Risk consideration to the Navy cyber infrastructure appears to be focused toward information and network security and financial savings than toward the redundancy and resiliency needed to overcome catastrophic black swan events. Current DoD acquisition risk assessment methodology uses pattern analysis and previous experience, but focuses on single-failure scenarios. This "what if" versus "how can (it happen)" analysis is more often used because multi-failure scenarios have a low probability of occurrence. Searching for the black swan scenarios, or "how can" scenarios, as part of the risk analysis is critical to creating layers of protection that have the ability to prevent the event, if possible, but recover from it when necessary.[5] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> But, FAR costs money and our quest for economy may be reducing the capacity needed to overcome black swan events. The DoD acquisition system is a top-down process that has its own institutional inertia and sometimes lacks critical thinking, innovation, and adaptation. The current acquisition process considers low-probability events and scenario-based planning, but constrains them to what it believes is plausible and fundable, limiting the inclusion of creative and critical thinking.[6] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> It is necessary to think “bigger” about the risks. Defense forecasting, or predicting the future operational environment, is used in DoD's planning, programming, budgeting, and execution system (PPBES), and is, "generally static, linear, and reasonably mechanical" in its approach.[7] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> It focuses on a capabilities versus risk approach.[8] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> The Joint Capabilities Integration and Development System (JCIDS) and PPBES, one could argue, is similar to the single-failure scenario based analysis described earlier. It is not necessarily suited toward multiple-failure scenarios needed for the complex cyber systems of the future. The future will demand the balance of technology maturity and cost. In the early stages of the defense acquisition process for cyber technology, leaders must ensure that a risk management approach and not just a capabilities approach is used. The cyber infrastructure key performance parameters (KPP) and key systems attributes (KSA) should represent a possible future multi-failure and cyber black swan environment. Additionally, network-ready key performance parameters (NR-KPP) must measure survivability and recovery, not just operation. Testing of KPP, KSA, and NR-KPPs will require a new lens from which to develop testing and assessment methodology. *Recommendation* The DoD must accept that black swan events will likely accelerate in the growing complexity of the cyber domain. The analysis used at the strategic level to make cyber infrastructure decisions must shift from a single-failure to multi-failure view. Emphasizing "FARness"–that is flexibility, adaptiveness, and robustness in acquisition decisions is key. [9] <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> To identify "FARness" attributes, the use of brain-storming and subject matter experts focusing on developing multi-failure scenarios for a proposed cyber infrastructure should be used. This "how can" approach creates robust scenarios approaching black swan type events and can identify ways the system could recover from a catastrophe–a type of "war-gaming." Identifying common recovery methods or needed attributes through “how can” scenarios would help decision makers think about the system within the context of a future environment and the "FARness" needed to survive. *Conclusion* In an effort to become more efficient and save money, the strategic leadership may not see the potential for black swans hidden in the cyber domain forest. Layered protections and redundancy are needed to survive a cyber-black swan event and must be considered in the analysis and decision making for future virtualization, cloud-computing, and data-center consolidation. It is with regard to probabilities that decision making based more on fiscal conservation makes the future force vulnerable. While history shows that black swan events will occur, it is up to the leadership to equip the future force with cyber systems that have "FARness"–yet fit within today's budget. *End Notes* [1]William R. Burns and Drew Miller, "Improving DoD Adaptability and Capability to Survive Black Swan Events," *Joint Forces Quarterly*, 1st Quarter 2014, 32. <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [2]Christopher Perry, "Security for Cloud Computing," *DON IT resources*, May 18, 2010,http://www.doncio.navy.mil/ContentView.aspx?id=1744 (accessed February 1, 2015). <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [3]Department of the Navy Chief Information Officer, "How Will DON Data Center Consolidation Cut Costs? Published, March 5, 2012," March 5, 2012, http://www.doncio.navy.mil/ContentView.aspx?ID=3793 (accessed January 29, 2015). <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [4]Eric Griffith, "What Is Cloud Computing?" *PC Magazine*, March 13, 2013, http://www.pcmag.com/article2/0,2817,2372163,00.asp (accessed April 17, 2014). <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [5]John F. Murphy, *Beware of the Black Swan: The Limitations of Risk Analysis for Predicting the Extreme Impact of Rare Process Safety Incidents* (Houston, TX: 8th Global Congress on Process Safety, April 1-4, 2012) http://www.allriskengineering.com/library_files/AIChe_conferences/AIChe_... <http://www.allriskengineering.com/library_files/AIChe_conferences/AIChe_201…> (accessed February 1, 2015): 2-7. <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [6]Ibid., 34-35. <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [7]Dan Cox and Michael Mosser, "Defense Forecasting in Theory and Practice: Conceptualizing and Teaching the Future Operating Environment," *The Small Wars Journal*, January 4, 2013, http://smallwarsjournal.com/jrnl/art/defense-forecasting-in-theory-and-p... <http://smallwarsjournal.com/jrnl/art/defense-forecasting-in-theory-and-prac…> (accessed January 20, 2015). <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [8]Ibid. <http://t.sidekickopen16.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XZs1…> [9]Burns and Miller, "Improving DoD Adaptability and Capability to Survive Black Swan Events," -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

1 0

Reinventing the Wheel
by jim bell 25 Aug '15

25 Aug '15

https://twitter.com/antonioregalado/status/631840159466696704 citing http://www.technologyreview.com/news/540151/bitcoins-dark-side-could-get-da… Partial quote:"Some of the earliest adopters of the digital currency Bitcoin were criminals, who have found it invaluable in online marketplaces for contraband and as payment extorted through lucrative “ransomware” that holds personal data hostage. A new Bitcoin-inspired technology that some investors believe will be much more useful and powerful may be set to unlock a new wave of criminal innovation.That technology is known as smart contracts—small computer programs that can do things like execute financial trades or notarize documents in a legal agreement. Intended to take the place of third-party human administrators such as lawyers, which are required in many deals and agreements, they can verify information and hold or use funds using similar cryptography to that which underpins Bitcoin.Some companies think smart contracts could make financial markets more efficient, or simplify complex transactions such as property deals (see “The Startup Meant to Reinvent What Bitcoin Can Do”). Ari Juels, a cryptographer and professor at the Jacobs Technion-Cornell Institute at Cornell Tech, believes they will also be useful for illegal activity–and, with two collaborators, he has demonstrated how.“In some ways this is the perfect vehicle for criminal acts, because it’s meant to create trust in situations where otherwise it’s difficult to achieve,” says Juels.In a paper to be released today, Juels, fellow Cornell professor Elaine Shi, and University of Maryland researcher Ahmed Kosba present several examples of what they call “criminal contracts.” They wrote them to work on the recently launched smart-contract platform Ethereum.One example is a contract offering a cryptocurrency reward for hacking a particular website. Ethereum’s programming language makes it possible for the contract to control the promised funds. It will release them only to someone who provides proof of having carried out the job, in the form of a cryptographically verifiable string added to the defaced site.Contracts with a similar design could be used to commission many kinds of crime, say the researchers. Most provocatively, they outline a version designed to arrange the assassination of a public figure. A person wishing to claim the bounty would have to send information such as the time and place of the killing in advance. The contract would pay out after verifying that those details had appeared in several trusted news sources, such as news wires. A similar approach could be used for lesser physical crimes, such as high-profile vandalism.“It was a bit of a surprise to me that these types of crimes in the physical world could be enabled by a digital system,” says Juels. He and his coauthors say they are trying to publicize the potential for such activity to get technologists and policy makers thinking about how to make sure the positives of smart contracts outweigh the negatives.“We are optimistic about their beneficial applications, but crime is something that is going to have to be dealt with in an effective way if those benefits are to bear fruit,” says Shi.Nicolas Christin, an assistant professor at Carnegie Mellon University who has studied criminal uses of Bitcoin, agrees there is potential for smart contracts to be embraced by the underground. “It will not be surprising,” he says. “Fringe businesses tend to be the first adopters of new technologies, because they don’t have anything to lose.”[end of partial quote]

3 2

Re: Reinventing the Wheel
by wirelesswarrior＠Safe-mail.net 25 Aug '15

25 Aug '15

Jim, I'm more than a bit surprised that Ari says he's surprised. I think he's been around in the digital currency arena for decades and perhaps is only feigning surprise that social outliers and criminals are early adopters of disruptive technology. If one acknowledges that governments routinely exempt themselves from many of the criminal statutes applied to citizens (including murder) then the ability of those outside the halls of power to use these new services to their upmost can only be to the long term benefit to society even if some "elite's eggs are broken" to make new social compact omlettes. WW -------- Original Message -------- From: jim bell <jdb10987(a)yahoo.com> Apparently from: cypherpunks-bounces(a)cpunks.org To: Cpunks List <cypherpunks(a)cpunks.org> Subject: Reinventing the Wheel Date: Tue, 25 Aug 2015 05:32:57 +0000 (UTC) > https://twitter.com/antonioregalado/status/631840159466696704 > > citing > > http://www.technologyreview.com/news/540151/bitcoins-dark-side-could-get-da… > > Partial quote: > "Some of the earliest adopters of the digital currency Bitcoin were criminals, who have found it invaluable in online marketplaces for contraband and as payment extorted through lucrative ransomware that holds personal data hostage. A new Bitcoin-inspired technology that some investors believe will be much more useful and powerful may be set to unlock a new wave of criminal innovation. > That technology is known as smart contracts small computer programs that can do things like execute financial trades or notarize documents in a legal agreement. Intended to take the place of third-party human administrators such as lawyers, which are required in many deals and agreements, they can verify information and hold or use funds using similar cryptography to that which underpins Bitcoin. > Some companies think smart contracts could make financial markets more efficient, or simplify complex transactions such as property deals (see The Startup Meant to Reinvent What Bitcoin Can Do ). Ari Juels, a cryptographer and professor at the Jacobs Technion-Cornell Institute at Cornell Tech, believes they will also be useful for illegal activity and, with two collaborators, he has demonstrated how. > In some ways this is the perfect vehicle for criminal acts, because it s meant to create trust in situations where otherwise it s difficult to achieve, says Juels. > In a paper to be released today, Juels, fellow Cornell professor Elaine Shi, and University of Maryland researcher Ahmed Kosba present several examples of what they call criminal contracts. They wrote them to work on the recently launched smart-contract platform Ethereum. > One example is a contract offering a cryptocurrency reward for hacking a particular website. Ethereum s programming language makes it possible for the contract to control the promised funds. It will release them only to someone who provides proof of having carried out the job, in the form of a cryptographically verifiable string added to the defaced site. > Contracts with a similar design could be used to commission many kinds of crime, say the researchers. Most provocatively, they outline a version designed to arrange the assassination of a public figure. A person wishing to claim the bounty would have to send information such as the time and place of the killing in advance. The contract would pay out after verifying that those details had appeared in several trusted news sources, such as news wires. A similar approach could be used for lesser physical crimes, such as high-profile vandalism. > It was a bit of a surprise to me that these types of crimes in the physical world could be enabled by a digital system, says Juels. He and his coauthors say they are trying to publicize the potential for such activity to get technologists and policy makers thinking about how to make sure the positives of smart contracts outweigh the negatives. > We are optimistic about their beneficial applications, but crime is something that is going to have to be dealt with in an effective way if those benefits are to bear fruit, says Shi. > Nicolas Christin, an assistant professor at Carnegie Mellon University who has studied criminal uses of Bitcoin, agrees there is potential for smart contracts to be embraced by the underground. It will not be surprising, he says. Fringe businesses tend to be the first adopters of new technologies, because they don t have anything to lose. > [end of partial quote] > > >

1 0

Fwd: [cryptome] The Gloves are Off: Diana Roark back in the Fray:
by coderman 24 Aug '15

24 Aug '15

---------- Forwarded message ---------- From: Douglas Rankine2001 <douglasrankine2001(a)yahoo.co.uk> Date: Sat, 22 Aug 2015 21:49:38 +0100 Subject: [cryptome] The Gloves are Off: Diana Roark back in the Fray: See url: https://cryptome.org/2015/08/drake-001.pdf Is there no stopping this woman... J. Now, William Binney, J Kirk Wiebe, Ed Loomis and Tim Drake, And Diane Roark, all of those involved in Thin Thread fame have got together to mount a law suit against the US intelligence establishment Has enough evidence come out from the likes of Snowden and other whistleblowers to sufficiently destroy the credibility of the leaders of the US intelligence services, and their hangers on, one wonders? Will the curtain open on the National Security stage and divulge the incompetent capers and conspiracies and corruptions which hide those affairs of the leading actors, who are dressed up in the clothing of secrecy, like transvestites at Cinderella's Ball... A lot of civil servants have turned to Ashley Madison to conduct their external affairs, now that posting messages on a Yahoo account is so well known... J. Interesting times...Well worth a read... As I have said before, court cases...no matter the outcome, can throw some interesting light on those areas of the dark web of intelligence.J. Certainly opening up new aspects of trailblazing. Enjoy... J. ATB Dougie.

1 0

Re: NSA Spying Relies on AT&T'S "Extreme Willingness to Help"
by Softy 23 Aug '15

23 Aug '15

> > > appears to stand up well. I believe it's very possible that > Snowden never obtained access to the useful and relevant technical > documents that seem to be missing from his dump: > > http://www.globalresearch.ca/nsa-deception-operation-questions-surro > und-leaked-prism-documents-authenticity/5338673 > > :o/ > This speaks to the success of the SCI model, more than anything about Snowden. He had widespread network access - but not specific compartmental access. I would guess rather than risk exposing himself he intentionally didn't (or couldn't) attempt an active spoof of credentials needed to gain SCI access - which is where the technical details live. Everything I have seen dumped from his trove is purely presentational/summary reports handed around between offices/echelons and posted on intranets for dissemination. Granted in much detail, but it's not the the source, as it were. I have been curious since the start to see if any of the future releases from the Snowden Cache reveal any actual technical source documentation. There might well be some, and not being released for a variety of legit (and not) reasons. Conversely as per above, it's more than likely there isn't any whatsoever. In the big picture those details don't change the validity of the trove -- any criticism based on the 'lack of code' is purely an apologist or diversion tactic. I think the situation speaks for itself: Managerial reporting to higher speaks to tech capabilities just as great as actual tech source. Similarly, intent is very difficult to discern from knowing technical ability, however is readily gleaned from managerial planning/status updates - especially at higher echelons.

3 2

Truecrypt container hacked?
by Tomas Overdrive Petru 23 Aug '15

23 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This one has been puzzling me for several days. Since I have not yet been able to figure it out, I thought I would "bleg" for assistance from our encryption-savvy readership. According to the Sun Sentinel <http://www.sun-sentinel.com/news/fl-christopher-glenn-sentenced-20150731-st…>, a South Florida man was recently convicted of stealing military secrets. I am less concerned with what he stole or why than with what the story says about how the evidence against him was identified and used. Here is the relevant part of the story: https://www.lawfareblog.com/puzzling-encryption-story - -- “Borders I have never seen one. But I have heard they exist in the minds of some people.” ― Thor Heyerdahl projects...................https://brmlab.cz/user/overdrive twitter....................https://twitter.com/#!/over2393 GnuPG key FingerPrint......08EA E4DC EF85 0F02 9267 5B48 2E58 6902 C5F8 794C -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJV2PKdAAoJEC5YaQLF+HlMTP0QAKEDUE5WcEXNPU35Rzd/FsDa WujrzPcsp4M9yCqBc5ycALmYHoeAkrEgvvDtH8rAgh5wnoEWV8eKnbLJvPxRHbM7 81LJehw9lA0Wuh2TouxISAPkAFnk1B1fwHoMOsS05I9CqbnjUR3o9Nh4cqbMmOfL sZL8WuuoUiQd/NGATXtu9c9166xeJIYljrHOl+YuLIkmQ1ne56J7NNTzEbJmrGCv ny1tGaIRaNs4kZ9QeWiEAWY6yXqRzmaGbDRr8JHy6fDvD8xUi8PmtqE8YMYx4Dnw j06k+VbPHyToDncOBB62/mb/rmddcM1/84bk/S8vVedkVjsLjWLMvX0EWghtMLRj 3X8q/lqNMmtC1Q2MydqGzmXQabkoddC6wutQzXsusqXSIt0a43irvql8bSXBhn3G bDUTKU7dyhKJnl0URWWoeY/s6O+KimQhj9nEoE8a5jUHJN3mteVjmSZigRSjxnF2 uahHQLMs2J4g/cQd5M3HHIJDOybV9JWchrSZxpN6x7nscRPIAK5zxVcCsZS6A7By kQNzMP3wmzuzfSoauqmkf8m0Xs8HBRTnlR8gaGGr/D3pRyjaIPZ6xSLHZqSRbWgN 8sgSb47wKAp90EnOvIQJOZd/CnApOtvsAoWNxe+r2m3Vvi9KegJSDw0qPOecpQiT pFfnecTukts6LdjSfFLp =k/HW -----END PGP SIGNATURE-----

5 4

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 22 Aug '15

22 Aug '15

On 8/21/15, Mike Perry <mikeperry(a)torproject.org> wrote: ... >> For those into researching other flow capabilities... >> There are also some probes in OS kernels and >> some other opensource taps, they're not as well known >> or utilized as nProbe. >> Other large hardware vendors include Brocade, Avaya, >> Huawei, and Alcatel-Lucent. > > Out of all of these, I was only able find info on Alcatel-Lucent. It > uses cflowd, which appears to be a common subcomponent. It's timeout > ranges are the same as Cisco IOS. for posterity, it would also be useful to scrutinize behavior of: - Arbor Peakflow SP - Narus Insight Manager - Lancope StealthWatch Xe with respect to soft or hard fixed NetFlow limits within analysis or as pushed to tapped switches. best regards,

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 22 Aug '15

22 Aug '15

On Sat, Aug 22, 2015 at 1:09 AM, Mike Perry <mikeperry(a)torproject.org> wrote: > As such, I was only able to discover that its default inactive/idle > timoeut is 30s. I couldn't find a range. > What I really need now is any examples of common routers that have a > default inactive/idle timeout below 10s, or allow you to set it below 10s. Not common unless you consider all the places where software is being used as a network tap, whether by legit operator, or by adversary. nProbe can timestamp in milliseconds. [ 21] %LAST_SWITCHED %flowEndSysUpTime SysUptime (msec) of the last flow pkt [ 22] %FIRST_SWITCHED %flowStartSysUpTime SysUptime (msec) of the first flow pkt [152] %FLOW_START_MILLISECONDS %flowStartMilliseconds Msec (epoch) of the first flow packet [153] %FLOW_END_MILLISECONDS %flowEndMilliseconds Msec (epoch) of the last flow packet Some define and assignment logic sets the defaults. It's software so anyone could adjust the options to at least fall within the "hardcoded" integer type... 1 to u_short. That doesn't mean it's sensible or that other bits in the code won't need munged, I didn't look. u_short idleTimeout, lifetimeTimeout, sendTimeout; #define DUMP_TIMEOUT 30 /* seconds */ readOnlyGlobals.idleTimeout = DUMP_TIMEOUT; readOnlyGlobals.lifetimeTimeout = 4*DUMP_TIMEOUT; readOnlyGlobals.idleTimeout = atoi(optarg); readOnlyGlobals.lifetimeTimeout = atoi(optarg); if(readOnlyGlobals.lifetimeTimeout == 0) { readOnlyGlobals.lifetimeTimeout = 1; printf("[--lifetime-timeout|-t] <timeout> | It specifies the maximum (seconds) flow\n" " | lifetime [default=%d]\n", readOnlyGlobals.lifetimeTimeout); printf("[--idle-timeout|-d] <timeout> | It specifies the maximum (seconds) flow\n" " | idle lifetime [default=%d]\n", readOnlyGlobals.idleTimeout); > I think these devices are wandering into the "adversarial admin" > territory (see section 3 of the proposal). I want to focus on the case > where the adversary demands/sniffs/exploits routers likely to be > installed in most networks. Sniffs... Lavabit was [nearly/actually] forced to install devices on his network for some while, so I see no "Sorry, my vendors config range doesn't support it" distinction here. Telecoms like AT&T don't fight, and Vampires don't care. Demands... The point with the NICs is that even 100Gbit taps are old news. With that comes deployment of flow / bro / etc like things that use them and the logs get saved because humans love to create collect and save useless stuff... to supply on demand. Software taps are popular, probably moreso at the network edges... universities, corp, regional / city, colo, etc. But costs are dropping, tech is rising, depts are doing these things. Yes, a legit operator may be unlikely to adjust, or to set the timeouts too low on their own free will since: 1) why, 2) storage space, 3) processing cpu / bandwidth Exploits... It's all software in the end. I know, I'm partly diverging from legit operator context.

1 0