- cypherpunks@lists.ogf.org

Microsoft patch batch pre-alerts now for paying customers ONLY
by Georgi Guninski 12 Jan '15

12 Jan '15

http://www.theregister.co.uk/2015/01/09/ms_restricts_security_pre_alerts/ Microsoft is facing fierce criticism over its decision to make pre-notification of upcoming patches available only to paid subscribers. The Advance Notification Service (ANS) formerly made information on upcoming software patches available to the public but from now on the information will be restricted to “premier” customers and some other select partners.

2 3

Re: full year 2014 corpus - better concurrent continue
by coderman 12 Jan '15

12 Jan '15

"why this format?" - it is lowest common denominator, in a sense. the rest explained later... but first, a fix. there is an issue with commands that won't continue past the PDF and small file bundles. use fix below to run or more continuation downloaders: ### The gist of a quick continue download: (many can be run in parallel) # # Update torsunget.sh and run dl-fy2014.sh to complete. # # assumes a copy of https://peertech.org/files/fy2014lst.txt # or 84fe6b33e5b6f2478523432514fcb24b844105c4a38635ba97543e9c7152f90e # in current working directory where ./dl-fy2014.sh is run. # # E.g.: curl -x http://127.0.0.1:8778/ -o fy2014lst.txt \ # http://bigsun36arflx75h.onion/shid/84f/e6b/84fe6b33e5b6f247..7543e9c7152f90e # rm -f torsunget.sh >/dev/null 2>&1 curl -x http://127.0.0.1:8778/ -o torsunget.sh \ http://bigsundaawafn36e.onion/torsunget.sh.txt \ && chmod +x torsunget.sh curl -x http://127.0.0.1:8778/ -o dl-fy2014.sh \ http://bigsundaawafn36e.onion/dl-fy2014.sh.txt \ && chmod +x dl-fy2014.sh time ./dl-fy2014.sh

1 0

Re: full year 2014 corpus - kudos to Cryptome & honor to Aaron
by coderman 11 Jan '15

11 Jan '15

On 1/3/15, coderman <coderman(a)gmail.com> wrote: >... > it is: > 47G, 63504 files, sig attached. > https://peertech.org/files/fy2014lst.txt some interesting details encountered, but it's ready. and in time for Aaron... most complicated distribution process ever? at least speed over Tor is good with this method... *grin* also avail at: http://bigsunt6eqt4tifc.onion/fy2014.txt http://bigsunymgzz5mdo3.onion/fy2014.txt http://bigsunr6tzikxo25.onion/fy2014.txt http://bigsundaawafn36e.onion/fy2014.txt http://bigsunklsutevagb.onion/fy2014.txt http://bigsunz7cmjr3hbd.onion/fy2014.txt http://bigsunkptoygblan.onion/fy2014.txt http://bigsun36arflx75h.onion/fy2014.txt http://bigsunndmif7ac5w.onion/fy2014.txt best regards,

1 0

TrustLeap: provably-secure, "forever unbreakable" security
by 42 11 Jan '15

11 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The CEO of TrustLeap contacted me recently to boast about his "unbreakable" security, and that 'we' are doing everything wrong and "all open source software is backdoored". Quotes from the website: > TrustLeap can mathematically prove that it has "unbreakable > encryption" against unlimited computing power, forever, and by-design. > As a result, "modern" cryptography (all the algorithms used today, > either standard or custom) is _provably unsafe_. http://twd-industries.com/faq.html#tab3 What do you think about that? There is a challenge: http://twd-industries.com/challenge.html > This is a page for real experts in cryptography ...so I thought I'll share it with you guys. - -- 42 <42(a)enigmabox.net> -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBAgAGBQJUrGnlAAoJELqmW1wGWUSY2aMP/1qGTSdnqZZLRqFH/ZHS1XkY vVwSbR7H8L1vKMFYxxBgQcgMrB3ky+He1xYjX5B/6Pfwi3aFYH/5xgJMdx75fTYP EVIF8SHctbWs49g6+dynLgcdCwHrLtF35BIj3QmIgBo8vYUMtS1JQ7/iwbwLZlw3 3+s7ycMEW2U/ltdhG6dV1xL+oXBHpVv3EeW7LHNL5RvcAN6SFU1YNkvjedfqnKxB so6gh7adcsFf5aij6ofkQKHYyTTdkilGwQa06Xj5Ht3gBWi+NIbglkVsgS/+/Xwx mq8trrlz3MO3eCt/atpseeWwgThfaTf9B/dgnd7JuRQzK+Vmvtrj/d6wjbW2wmQW yCXz3n2Y0WxozipHJSd1yXL2SuumB3YSZ06ZLVUg0RmEluGCXVg7oALri+srEKUs PBLWJmWKpQM/8DsA8cqUEvyELFs1WBjzIQg2Bsg0j1IvMrXZSAApoMxEXxibSf0V oOiqApPUThlfB1V1CCU0jRgW2mYmKvU2eq05iYx1ZyyUid4gQlFt0KsO3Hh2e0VK 57XJjNwFeg7iSbJ7kIGduryVxDulu7SqabLKr7WUpQfCYxP0kTjTqXI44R5fHr00 4D6nb/mzPF3IxSfQ2Wv/SJ4AFeYTe8d1tdVdLqF8z4n6Noo4yExArD6VwVT6wF5r Kyyxt5DAcslRFZbOJA/6 =wU4H -----END PGP SIGNATURE-----

4 3

Firechat's Amazon S3 instance got blocked in Russia
by Anton Nesterov 10 Jan '15

10 Jan '15

So firechat.s3.amazonaws.com with IPs 54.231.13.81, 54.231.13.89, 54.231.2.105, 54.231.32.137, 54.231.8.89, 54.231.9.17, 54.231.96.161 was blocked in Russia by order 27-27-2014/Ид4349-14 of General Prosecutor. That instance was used by Firechat to over-the-internet chats. Firechat became very popular in Russia in last days (it's got to the top of Apple's App Store) because of it's mesh-chat function and because of planned rallies in support of Alexei Navalny. Rally was planned on 15 Jan, but as court yesterday decide to move the date of sentence to 30 Dec, it happened today. Alexei Navalny got 3.5 years of suspended sentence, and his brother, Oleg, was jailed for 3.5 years. This is the first time when some service got blocked that way, before that there was only websites. It's not a big deal because of mesh chat. Both firech.at & opengarden.com/firechat wasn't blocked and still works, downloads from App Store & Google Play are fine too. Due to how ISPs block things (IP blocking mainly), Russian users also got a problems with many services which use S3. https://meduza.io/news/2014/12/30/tehnicheskiy-domen-messendzhera-firechat-… (Russian) http://www.theguardian.com/world/2014/dec/30/kremlin-critic-navalny-given-s… (English) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

2 3

Re: Meet the iMarker, Russian targeted ad service which analyze your traffic on ISP side
by Anton Nesterov 10 Jan '15

10 Jan '15

Actually, it seems like *it is* Phorm. They mention yourself as Phorm's representatives in Russia here: https://www.facebook.com/imarker.ru/photos/a.340885905946086.85421.33286551… Seems like Phorm bought them at the some stage, and that tweet from iMarker founder says they fired him https://twitter.com/mberlizev/status/501487701124972544, also some info about replaced software inside ISP networks without their knowledge https://twitter.com/mberlizev/status/497329705163710464, another posts in Mikhail Berzliev's company ADEx FB mention takeover by Phorm https://facebook.com/adex.provider/posts/630807190348314 https://facebook.com/adex.provider/posts/630182937077406 Virilha: > It remembers me about Phorm at UK, BR, some other countries also. > > There is a firefox addon to detect / scramble / block this kind of > redirects URLs, generating random unique IDs to throw garbage on the > data the ISP collects. > > https://www.dephormation.org.uk/?page=2 > > But seems its not open source. > > --Virilha > > ----- Message from Anton Nesterov <komachi(a)openmailbox.org> --------- > Date: Thu, 08 Jan 2015 20:45:13 +0000 > From: Anton Nesterov <komachi(a)openmailbox.org> > Subject: Meet the iMarker, Russian targeted ad service which analyze > your traffic on ISP side > To: cypherpunks(a)cpunks.org > > >> How it works? >> >> ISPs install the iMarker equipment and mirror all user's traffic on it >> (Russian surveillance system, SORM, works the same way). Software takes >> time, URL and HTTP Headers from HTTP requests. Then scraper with IP >> 92.242.35.54 and User-Agent WebIndex follow every visited URL and >> analyze its content. All this information used to build a profile for >> user. They says that information is removed right after analysis, and >> software saves only result of that analysis. Their website lists that >> they categorize users by search queries, online shopping activity, time >> of visits, activity on social networks, keywords on visited pages, >> visited websites, social-demographic info, such as sex, age, marital >> status, and education level, and then they use that data to distribute >> users for consumers groups. Every user has some kind of pseudonymous ID >> with linked profile. >> >> It's also has an opt-out option http://www.imrk.net/status >> >> >> How many users affected? >> >> They says it's 38 million people all over Russia. Minister of >> Communication Nikolay Nikiforov said in 2014 there was 62 million people >> in Russia using Internet, 56m of them do it every day, so it's 61% of >> Russian Internet users. iMarker's website list Akado, Rostelecom, >> ER-Telecom, NetByNet, Qwerty, and TTK as ISPs that installed iMarker's >> equipment. >> >> >> How to check if this affects you? >> >> If you are a client of Russian ISP, you can check it here >> http://imarker.valdikss.org.ru If you own a webserver, grep the logs for >> connections from 92.242.35.54. >> >> >> How do check script works? >> >> It generate a random link and wait for 3 seconds for connection from >> iMarker's IP address. >> >> >> How long iMarker works? >> >> Company start work on January 2010, commercial sells started on August >> 2011. >> >> >> >> http://imarker.valdikss.org.ru/ — script that checks if your ISP use >> iMarker >> http://www.vedomosti.ru/tech/news/15669231/bolshoj-reklamnyj-brat — >> report on iMarker from 2013, says they are ready to provide free DPI to >> ISPs in exchange of user's data (Russian) >> http://sporaw.livejournal.com/347832.html — blog post quoting private >> mails from iMarker's crew (Russian) >> http://www.imrk.net/privacy — TOS (Russian) >> http://habrahabr.ru/post/247465/ — blog post about iMarker (Russian) >> http://www.imarker.ru/ — iMarker website (Russian) >> http://www.imrk.net/status — opt-out page (Russian) >> http://minsvyaz.ru/ru/news/index.php?id_4=44571 — Nikiforov's statement >> on number of Russian Internet users (Russian) >> >> -- >> https://nesterov.pw >> GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 >> https://keybase.io/komachi/key.asc > > > ----- End message from Anton Nesterov <komachi(a)openmailbox.org> ----- > > > > > -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

2 2

Re: [cryptography] NSA Attacks on VPN, SSL, TLS, SSH, Tor
by John Young 10 Jan '15

10 Jan '15

Cryptome does not pretend to provide illusory security, that is security. It is a vile, rotten, corrupt endeavor, like life. Chuckle. Visitors, readers, consumers must be skeptical of security, and not rely upon security promoters, their followers and investors who exploit dependency by fear uncertainty and doubt. Skepticism of security claims and methods is one of the purposes of these lists. Perhaps the main purpose, although it is commonplace for these lists to be used for soliciting befuddled consumers to hop aboard the gravy train. Now and then skeptcism of the security arises but is usually suppressed during times of crisis when incentive is rich to promote poor products and services. Governments, commerce, orgs, experts cooperate to foster crises under guise of opposition. This applies to all forms of security, safety, protection, defense, hygienic pharma. Still, Cryptome endorses the continuing struggle to improve citizen protection, not only as a job, career, industry, but as citizens' obligation to bear responsibility for the commonweal against its inside and outside enemies, if you will, common math against the deadly germs. One way to do that is to not oversell it, tone down the threats, reduce drumbeating, avoid hyperbole for and against, forego advertising, gang-bang hectoring, circle jerk conferencing, TEDing, prize bestowing, to quietly invent, improve, critique, test, apply, re-test often, expect to be deceived by colleagues witting or unwitting, especially by sales, politicians, authoritarians -- the persistent germs. At 02:50 AM 12/30/2014, you wrote: >john likes to be poetic as a wall - dear john please listen to the >smart people and have a small bit of humility - it will make you >better at your job and we need EVERYONE to step up and be better at their jobs > >On Tue, Dec 30, 2014 at 7:38 AM, grarpamp ><<mailto:grarpamp@gmail.com>grarpamp(a)gmail.com> wrote: >On Mon, Dec 29, 2014 at 8:20 AM, John Young ><<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > > Hash this motherfucker, said math to germ. > >JYA, you, as the original publisher of various and valued datasets... >the responsibility to calculate, sign, and publish said hashes rests with >you alone. Please consult with any trusted parties should you need >assistance in such matters. A future of archivers, disseminators, and >analysts will thank you. > > > > >-- >Cari Machet >NYC 646-436-7795 ><mailto:carimachet@gmail.com>carimachet(a)gmail.com >AIM carismachet >Syria +963-099 277 3243 >Amman +962 077 636 9407 >Berlin +49 152 11779219 >Reykjavik +354 894 8650 >Twitter: @carimachet ><<https://twitter.com/carimachet>https://twitter.com/carimachet> > >7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 > >Ruh-roh, this is now necessary: This email is intended only for the >addressee(s) and may contain confidential information. If you are not the >intended recipient, you are hereby notified that any use of this >information, dissemination, distribution, or copying of this email without >permission is strictly prohibited. >

12 21

Meet the iMarker, Russian targeted ad service which analyze your traffic on ISP side
by Anton Nesterov 09 Jan '15

09 Jan '15

How it works? ISPs install the iMarker equipment and mirror all user's traffic on it (Russian surveillance system, SORM, works the same way). Software takes time, URL and HTTP Headers from HTTP requests. Then scraper with IP 92.242.35.54 and User-Agent WebIndex follow every visited URL and analyze its content. All this information used to build a profile for user. They says that information is removed right after analysis, and software saves only result of that analysis. Their website lists that they categorize users by search queries, online shopping activity, time of visits, activity on social networks, keywords on visited pages, visited websites, social-demographic info, such as sex, age, marital status, and education level, and then they use that data to distribute users for consumers groups. Every user has some kind of pseudonymous ID with linked profile. It's also has an opt-out option http://www.imrk.net/status How many users affected? They says it's 38 million people all over Russia. Minister of Communication Nikolay Nikiforov said in 2014 there was 62 million people in Russia using Internet, 56m of them do it every day, so it's 61% of Russian Internet users. iMarker's website list Akado, Rostelecom, ER-Telecom, NetByNet, Qwerty, and TTK as ISPs that installed iMarker's equipment. How to check if this affects you? If you are a client of Russian ISP, you can check it here http://imarker.valdikss.org.ru If you own a webserver, grep the logs for connections from 92.242.35.54. How do check script works? It generate a random link and wait for 3 seconds for connection from iMarker's IP address. How long iMarker works? Company start work on January 2010, commercial sells started on August 2011. http://imarker.valdikss.org.ru/ — script that checks if your ISP use iMarker http://www.vedomosti.ru/tech/news/15669231/bolshoj-reklamnyj-brat — report on iMarker from 2013, says they are ready to provide free DPI to ISPs in exchange of user's data (Russian) http://sporaw.livejournal.com/347832.html — blog post quoting private mails from iMarker's crew (Russian) http://www.imrk.net/privacy — TOS (Russian) http://habrahabr.ru/post/247465/ — blog post about iMarker (Russian) http://www.imarker.ru/ — iMarker website (Russian) http://www.imrk.net/status — opt-out page (Russian) http://minsvyaz.ru/ru/news/index.php?id_4=44571 — Nikiforov's statement on number of Russian Internet users (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

3 2

Please stop top posting [was: TrueCrupt...]
by grarpamp 09 Jan '15

09 Jan '15

> On Sun, Jan 4, 2015 at 5:52 AM, Cathal Garvey <cathalgarvey(a)cathalgarvey.me> wrote: > > However, sorry, but I'll continue emailing as I always have done; if I > come from a different internet culture to you, and if top-posting is > anathema to you but not I, that's just ... lazy. You know the history and reasons the internet has against top posting, especially on newgroups and mailing lists. You and everyone else top posting are just lazy culture at the expense/abuse of other people, in particular the brain power needed to decipher your messages in both direction and context. Stop wasting hundreds of other people's cycles and invest some of your own. Learn trimming and interleaving replies, google it, make your mail art, not dog shit. (: shitter a as but asses lazy your to cost no it's all After. off else everyone pissing on keep, want all you what that's if But.

7 9

Re: cypherpunks Digest, Vol 19, Issue 11
by John Elicker 08 Jan '15

08 Jan '15

Please unsubscribe On Thu, Jan 8, 2015 at 10:00 AM, <cypherpunks-request(a)cpunks.org> wrote: > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: Rant on BSD vs GPL was [Good ol' BSD vs. GPL] (grarpamp) > 2. Re: Rant on BSD vs GPL was [Good ol' BSD vs. GPL] (Cathal (Phone)) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 8 Jan 2015 04:26:15 -0500 > From: grarpamp <grarpamp(a)gmail.com> > To: cypherpunks(a)cpunks.org > Subject: Re: Rant on BSD vs GPL was [Good ol' BSD vs. GPL] > Message-ID: > <CAD2Ti2_= > de+t7C3swNoJW9jx8kGJu9P2M_1bhauZ9P3xHvf30Q(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On Wed, Jan 7, 2015 at 12:24 PM, Ted Smith <tedks(a)riseup.net> wrote: > > On Wed, 2015-01-07 at 11:33 +0000, Cathal Garvey wrote: > >> The GPL acknowledges this by forbidding suits within the scope of the > >> work (I think: GPL experts on-list?), preventing E3 from occurring. > >> Other licenses often take steps in this direction, but the > >> ultra-short > >> "friendly and permissive" licenses usually don't > > Probably because their model and vision is different, they're > not really out to modify the world beyond saying "here you > go, it's free", only out to modify the code, so they've little > interest in legal longtexts or lawyers. > > >> terse and legally unenforceable way that they might as well not be. > > > > The GPLv3+ contains this sort of patent protection > > Section 10, last paragraph, last part. Don't know if that has been tested > in court as other parts have been in the news. And all of paragraph 11, > which grants patents. > > https://www.gnu.org/licenses/gpl.html > > >> Freedom is not merely defined in law but in experience, and simply > >> removing explicit limitations on freedom (copyleft licenses) does not > >> mean that the total freedom in the world has increased. > > > > BSD advocates, I think, are not interested in total freedom in the > > world. This is a CONSEQUENCE or OUTCOME of a choice, not the choice > > itself. > > > boils down to consequentialist morals on the GPL side, and deontological > > or rule-based morals on the BSD side. > > Yes, depends on definition of freedom. Unfortunately GPL and BSD people > seem define that differently. > > > ------------------------------ > > Message: 2 > Date: Thu, 08 Jan 2015 10:40:37 +0000 > From: "Cathal (Phone)" <cathalgarvey(a)cathalgarvey.me> > To: grarpamp <grarpamp(a)gmail.com>, cypherpunks(a)cpunks.org > Subject: Re: Rant on BSD vs GPL was [Good ol' BSD vs. GPL] > Message-ID: <249E482B-33E1-4653-B035-8D06B083F6AB(a)cathalgarvey.me> > Content-Type: text/plain; charset="utf-8" > > I don't think it's unfortunate, I think it's complementary. GPL is > valuable for trailblazing and stamping.out new territory because it > prevents E3, BSD is valuable because it helps shitty tech companies migrate > to standards that aren't total snakeoil. Between the two, the world > improves. Obviously I think GPL is better and more important, but that > doesn't mean I disparage or undervalue other open work. > > On 8 January 2015 09:26:15 GMT+00:00, grarpamp <grarpamp(a)gmail.com> wrote: > >On Wed, Jan 7, 2015 at 12:24 PM, Ted Smith <tedks(a)riseup.net> wrote: > >> On Wed, 2015-01-07 at 11:33 +0000, Cathal Garvey wrote: > >>> The GPL acknowledges this by forbidding suits within the scope of > >the > >>> work (I think: GPL experts on-list?), preventing E3 from occurring. > >>> Other licenses often take steps in this direction, but the > >>> ultra-short > >>> "friendly and permissive" licenses usually don't > > > >Probably because their model and vision is different, they're > >not really out to modify the world beyond saying "here you > >go, it's free", only out to modify the code, so they've little > >interest in legal longtexts or lawyers. > > > >>> terse and legally unenforceable way that they might as well not be. > >> > >> The GPLv3+ contains this sort of patent protection > > > >Section 10, last paragraph, last part. Don't know if that has been > >tested > >in court as other parts have been in the news. And all of paragraph 11, > >which grants patents. > > > >https://www.gnu.org/licenses/gpl.html > > > >>> Freedom is not merely defined in law but in experience, and simply > >>> removing explicit limitations on freedom (copyleft licenses) does > >not > >>> mean that the total freedom in the world has increased. > >> > >> BSD advocates, I think, are not interested in total freedom in the > >> world. This is a CONSEQUENCE or OUTCOME of a choice, not the choice > >> itself. > > > >> boils down to consequentialist morals on the GPL side, and > >deontological > >> or rule-based morals on the BSD side. > > > >Yes, depends on definition of freedom. Unfortunately GPL and BSD people > >seem define that differently. > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. >

5 4