- cypherpunks@lists.ogf.org

Re: [cryptography] Email encryption for the wider public
by grarpamp 17 Sep '14

17 Sep '14

On Wed, Sep 17, 2014 at 9:43 AM, Henry Augustus Chamberlain <henryaugustuschamberlain(a)gmail.com> wrote: > I propose that we use the local part of the email address to store the public key, > ... > my email address would be (64 random letters)(a)gmail.com > ... > Somebody not using encrypted emails could still click on your "mailto" > link and send you an email, although it will be unencrypted Putting keys into some_encoding(a)example.com might cover some bases related to offline key lookup and message validation. Most user and system mail tools would need changes to handle string width and keytype, addressbooks updated, etc. Totally burying OpenPGP, passphrase and key lookup/use behind a fully integrated MUA GUI for grandma would work just as similarly well right now today with no such encoding. But in the end, all you're doing is covering the message body, and in today's world that's clearly not enough. No one's yet solving the huge issues with leaving mail exposed to what is essentially open-for-all-to-inspect central storage and mail routing. The "who's IP talking to who", "From To Subject, daemon headers, etc" metadata, when, how much/often, provider logs, someone sending you unencrypted mail, you giving up your private keys to the provider or running blobs they provide to you, etc. This is all unfixable with traditional "Email" models. This is why that to really solve anything more than the message body, you need to go completely nextgen and turn that 'email address' into an anonymous P2P overlay network node address, run your overlay client [which supplies a mail/messaging front end] and send/receive mail through that from/to your usual MTA/MUA/messaging toolchain. The real work there is in pushing the P2P node count up... - Research how many users globally might leave their messaging node up 24x7 for a direct realtime overlay connection with the far end "user@node"... 1/10/100/n*1000 million? - Develop message storage [and forward/poll/expiry] within the overlay for those that aren't in online mode. - Determine any hardware limitations and thin client models. There is an ongoing thread with the subject "The next gen P2P secure email solution" that contains various people's initial thoughts/framework on this.

1 0

Giganews Is an FBI operation - Giganews Denial Campaign Overdrive
by coderman 17 Sep '14

17 Sep '14

i thought the TAO catalog would be most volatile, but maybe Giganews Golden Frog debacle will take it... cryptome must be a hot seat! cool jya's buns with some bitcoin... [ http://cryptome.org/donations.htm ] :P best regards, --- http://cryptome.org/2014/09/giganews-denial.htm 16 September 2014 Giganews Denial Campaign Orchestrated PR against every leaker is to demonize: call the leaker a sad case who needs psychiatric help, whose life style is scrutinized for damning behavior aided by fabricated ruses and testimonies against the leaker. Officials, CEOs, lawyers, co-workers are set in motion to slur, ridicule, laugh at, scowl at, condemn, smear, pity and rage against the leaker. Retractions and redactions are demanded to protect he innocent. But never admit the truth of the leaks until after more leaks, then grudingly, with shallow apologies, layer by layer as the leaking continues. Attacks are initiated on the leaker's outlets and supporters, accusing them of being duped and hoaxed, demand that they too recant and admit being taken in by a crafty operator who did not understand the full picture, and was not a reliable worker. This is the pattern of cover-up, and it is widespread among malefactors working the same territory of duping the public on behalf of the government, usually after themselves being entrapped by officials and extorted into becoming informers and co-conspirators with officials. And if all goes well handsome contracts are used to cement the malefaction as a part of successful business of betrayal. This is what Nick Caputo revealed of Giganews, this is what Giganews must deny as formulaicly denied by Stratfor, by HG Gary, by Sabu, by Google, by Microsoft, by NSA, by DoJ, by FBI, on and on. --- http://cryptome.org/2014/09/giganews-fbi.htm 15 September 2014 Giganews Is an FBI operation Cryptome, Let me explain my history at Giganews in Austin, Texas and how I learned about the FBI connection. I used to be a huge fan of Usenet and a customer of different newsgroup providers for several years, and I started working at Giganews in 2009. I rose through the company, being promoted to a system technician after 6 months, and became a Giganews system engineer less than two years after that. A huge pirate at the time, I loved the idea of helping people download all the "rich multimedia content" they could. The porn content is not safe on Usenet, and the groups with children being abused I find abhorrent. Customers would write in about it all the time, so its no secret to a Usenet employee where it is. Data Foundry is a data center company which is interconnected to Giganews with the same admins, nocs, etc. Their main office headquarters is at 1044 Liberty Park Dr in Austin. But, they host most of the Usenet content in other data centers around the world. While talking to the CEO of the entire operation, Ron Yokubaitis, I heard what I interpreted as his request to remove the child pornography groups when he asked, "Would you delete child porn?" I honestly loved the thought of removing that junk off of Usenet, and removed three cp newsgroups soon afterwards. This happened December 11th, 2011. I didn't remove anything related to the normal and more socially acceptable content Usenet downloaders know about. It turned out that that wasn't what the CEO really wanted, who then claimed he forgot what he said. The Giganews/Data Foundry admins Philip Molter and Mike Smith disciplined me for removing the child porn groups and didn't trust me to keep working there afterwards. They made subtle references to jeopardizing criminal investigations IN PROGRESS then threatened me with a bad reference for removing the child abuse junk. No big deal, a bad reference from them after doing that is good, but Philip restored the cp content from a backup I didn't have access to. Fast forward several months, I turned into a traitor in an effort to remove the abhorrent junk off Usenet - I broke the first and second rules not to talk about it, and told the FBI the truth about the child abuse groups deletion in an email. This probably wont go over well with internet freedom lovers, but sharing what I learned in the experience will, I promise. My seemingly traitorous act exposed the real traitor, the biggest one, to the Usenet network. The FBI invited me to their unlisted Austin office in a nondescript office building at 12515 Research Blvd, Building 7, Suite 400 in late October 2012. Two agents took notes on what I told them, then something unexpected happened. Special Agent Scott Kibbey told me he personally knew the Giganews / Data Foundry CEO, bragged to me about working there, then invited me back to Giganews! I had also helped them with a separate crime venue in Austin that Data Foundry was going to compete with, so I had earned their trust. In addition, Kibbey offered me a new name and identity, with a new drivers license and everything, if I were to go back to work at Giganews. It was then that I realized that the fed I was talking to had been my coworker at Giganews since I started in 2009! The other agent was actually an Austin police detective named Charles Riley helping the FBI whom worked alternate shifts to me at the Datafoundry NOC under alias. Riley even bragged about being a detective once at a shift change! The thought of my fellow Usenet systech in crime being a police detective was unthinkable at the time. I've included some of the emails from these feds (with email headers and IP addresses) in the link at end. Special Agent Scott Kibbey is central to the whole Giganews operation, including Data Foundry, but with different names. This agent is a top exec for Data Foundry, a top admin for Giganews, the Golden Frog front company run from the same Usenet servers for VyprVPN, and the other Usenet fronts Usenet.net, Supernews, Rhino Newsgroups, and Powerusenet. Another business front name they used when I was there is Powerhouse Management. Kibbey rolled out the OS images, kernels, patches, setup the entire VyprVPN service including the detailed logging which is easily accessible to him and the other government agents working there. There were also rumors agents from other governments worked thereÂ The Hong Kong Giganews servers were brought down in early June 2009 by a Chinese employee, the day of the Tiananmen Square anniversary when the Chinese government was blocking everything online. This means the VyprVPN connecting IP addresses are accessible to the Chinese government indirectly through this employee. Anyone using the VyprVPN service that governments are targeting is in danger, honestly. This is my warning - that all of the content being downloaded and shared on the Usenet network is going through the authorities! Giganews customers are being logged! The log file is called the "gigauth" on their "cruncher" servers which logs every connection by every customer, which are then archived. This means Usenet uploaders are helping the feds monitor the distribution of Usenet content if their newsgroup provider peers with Giganews! I swear to you that Giganews is an operation that employs federal agents who run most of the operation. I suggest demanding from your newsgroup provider that they stop the peering of binary groups to FBI's Giganews. Please understand how risky this is for me to explain as Agent Kibbey subtly threatened my family on behalf of Data Foundry the second time I met both agents at the Austin FBI office. The traitors saw me as a threat and said I did not cooperate. Even with this threat, please warn Giganews customers and other Usenet users, and use the evidence I've linked. If the google drive link dies, email me for a new one. Agents Kibbey and Riley did not let me photograph them, but I did include a scan of their business cards. Riley didn't have an FBI badge or card, but he had an fbi.gov email address, ip, and Austin Police Department badge. I've linked pictures of my Giganews badge and the shirts with their red armor logo I was forced to wear when working there. I've also linked to the Giganews/Data Foundry employee list with in-office mug shots, phone numbers and emails they gave me. I did not agree to return this on their employee paperwork, so it is not illegal to share. They thought I did, though. I doubt the names and phone numbers they used internally are all real, as many are likely aliases and fed-routed voip proxies. Most of the emails changed to goldenfrog.com before I left from the ones listed in the 2011 employee pdf. Some of the mugshots are photoshopped by them, as the pictures did not match the physical appearance of some, likely to hide in case of someone like me exposing these traitors. Feel free to upload this to any newsgroup that Giganews carries - Their customers need to know. -Nick Caputo

2 1

PFS is a global, versioned, peer-to-peer filesystem
by Eugen Leitl 17 Sep '14

17 Sep '14

http://ipfs.io/ IPFS is a global, versioned, peer-to-peer filesystem. It combines good ideas from Git, BitTorrent, Kademlia, SFS, and the Web. It is like a single bittorrent swarm, exchanging git objects. IPFS provides an interface as simple as the HTTP web, but with permanence built in. You can also mount the world at /ipfs. How does it work? Read the paper http://static.benet.ai/t/ipfs.pdf

1 0

Palantir pricelist
by Eugen Leitl 17 Sep '14

17 Sep '14

https://news.ycombinator.com/item?id=8325441 Palantir Pricelist (page 27) [pdf] (gsaadvantage.gov) 173 points by thebyrd 15 hours ago | flag | 58 comments bane 10 hours ago | link For folks who've never seen one of these. 132-33 - Price for a Palantir server, priced per core. $141k per core. Includes 1 year of "maintenance" (support and software upgrades). 132-34 - This is the maintenance for second year on. $28k per core. How many users can a core support? I dunno. But let's say you can serve 50 people off of a 4-core system (you can redo the math for the number of users). You initial purchase is $564k. Or about $11k per user. Each year after that, if you want software updates, it'll cost you $113k or or about $2.2k per year per user. So let's say you use the system for 3 years. That's over $15k of software per user over that time. Plus there's training ~$2k per user. Or another $100k in training costs. And then who knows how many hours of engineering and "ninja" services. But a CONUS (within the U.S.) FSR is billed at about $300k per year for a full-time person on staff. Let's say you need two of them to support those 50 users. Added up for 3 years of Palantir: $1.5million I'll let you decide if that's good value, but that works out to around $30k per user partial TCO (not including power, security, networking, local IT staff support, etc.). reply elblanco 5 hours ago | link I've done a bit of work with Palantir. This is basically spot on. They're really cagey about the core/user requirement in real life so I'd be comfortable in saying most customer over purchase cores. They usually staff 2-3 full time guys for every 30-50 people and the implementation takes forever. I know of more than one place that didn't have a working system a full year after purchase. Meaning the maintenance had already expired on that first year. Your later comment about the crack model is also spot on. There's a fairly long list of disgruntled places that bought on discount and are now being hit with huge O&M maintenance fees and are looking for a way out. I think they're government customers are slowly going away. They're starting to show up more overseas here. Palantir recently opened up a Seoul office. But how much of whatever business they get out of it is government and how much of it is commercial is anybody's guess. reply Cthulhu_ 58 minutes ago | link Sounds... Actually doesn't sound as bad as SAP, Europe's largest software package/manufacturer for... IDK, business software. IIRC, every implementation requires you to hire half a dozen SAP engineers for a decent hourly rate just to set up the system, then keep them on to train and maintain the system. reply nostrademons 8 hours ago | link Not that out of line for what much other enterprise software costs. A Bloomberg terminal runs about $24k/user/year: http://qz.com/84961/this-is-how-much-a-bloomberg-terminal-co... When I was doing enterprise financial software it wasn't uncommon for contracts to run in the millions per year. reply bane 7 hours ago | link Yeah it kind of depends how you look at it. Is it specialty software that provides some critical function they can't get elsewhere? Or is it Microsoft Office, everybody gets it and it should really be like $150/seat. I should have also added to my original post, this is their GSA schedule. For these specific line-items, the government considers this the "prenegotiated lowest price". This simplifies purchasing. So if somebody in the government wants buy another core (item 132-33) they just ring up Palantir or their GSA schedule VAR (reseller) and ask for a 132-33 volume:1 and they know that it'll cost $141k and be good for 1 year of O&M. The downside of being on the GSA schedule is that it means that there are limits on your ability to change prices year to year to reflect a change in business environment. Say next year you want to drop the price by 50%. That's not allowed, since it would basically mean that you weren't selling your software at the lowest possible prenegotiated price. Similarly if you want to increase it, you're limited in that as well. I think the +- variance can't exceed 10% in a single 12 month period, but I might be wrong. The other downside is that this basically provides your prices in public so your competitors can see what you charge, which can be critical information in contract bids. There's always a loophole. For example, convince your customer to not buy off of the GSA and sell them a "package" at some discount off of GSA. That "package" counts as a different SKU and the GSA doesn't apply. So for example, you could make a Palantir "starter kit" composed of 2 core license (normally $282k) 1 extra year of O&M maintenance for both cores (normally $56k) 500 hours of Ninja Services @ $150/hr (normally $98k) 500 hours of CONUS FSR Service @ $120/hr (normally $73k) all for the grand total of $350k or some such, instead of the normal price of $510k. A $160k discount. Any government purchaser would fall over themselves to try to make this happen since it's a >30% discount off of the normal GSA schedule prices (which they can refer to and are governed by various rules). This looks fantastic on their yearly performance eval "-saved government $160k on purchase of Palantir package deal" This is the crack model. When the O&M runs out in two years and they come asking for more, well, there's no deal anymore, and the GSA schedule prices on O&M and people have gone up 20% in that time. edit keep in mind that this company has raised almost a billion dollars and is valued at something like $9 billion dollars. reply elblanco 5 hours ago | link > raised almost a billion dollars and is valued at something like $9 billion dollars. And now particular plans to sell or go public. This keeps all their financials private and the fact that they have to keep doing new fundraising rounds every few months does not make me think they're making money. At $9bil valuation, finding a buyer is going to be really tough. They're a really weird company to deal with too. A bit cultish, the CEO is kind of flake the few times I've met him at their conferences. I get the impression that he's not really running the show, he's impossibly unqualified with zero history in any of the spaces they sell into and no business background of any useful type. Their offices are nice, loads of free great food, but when people emerge from their offices for lunch it looks like they're on a death march. If you ask any of them if they like it there you'll always get a blank stare and a "I love it at Palantir, Palantir is great" answer. Combined with the track jackets and sketchy legal history (well worth a read), it's kind of off-putting. reply msh 4 hours ago | link Can you provide a link on the last line? reply elblanco 1 hour ago | link eldemar is providing some of the information. I'd add some color the i2 suit. The fraud perpetrated by Palantir was actually so organized and so bad (they set up an entirely fake front company in another state), that the suing company asked the judge for the case to be tried under RICO rules...which are basically rules put in place to fight the mafia. The judge agreed that it qualified under the law (immediately tripling any damages that would have been awarded) and Palantir settled with i2 immediately after that and the case was dropped. Word on the street is the settlement was for an almost 9 figure sum and Palantir immediately went into another fundraising round to cover the loss and sustain operations. The employees (all senior execs) at the center of the fraud kept their jobs but didn't show their faces in public for a couple years (they had been acting as a de facto spokespeople during trade events). They're back in the public eye now. Yes, that's correct, Palantir is currently run by people who's activities were qualified by a judge as falling under legal guidelines setup to fight the Mob. You can say what you want about the big defense contractors, incompetence and lobbying and all that (which Palantir does in spades and has even gotten in trouble for not disclosing some lobbying deals) but mafioso they ain't. Some more here: http://venturebeat.com/2011/02/16/palantirs-third-black-eye-... http://www.law360.com/articles/225544/palantir-i2-settle-tra... This isn't even touching the HBGary union busting scheme and the Bank of America anti-Wikileaks proposal. And other very anti-democratic activities. I don't know what happened to the employee with the anti-Wikileaks deal, but the one with HBGary was the stuff of dystopian nightmares. The employee responsible was publicly terminated but actually it turns out was just sent away for a bit and then quietly either rehired or just turned back up to a job he never lost. Nobody would have ever known about this if Anonymous hadn't had a very public fight with the CEO of HBGary Federal and hacked their network to pull down some documents, revealing an ongoing 3-way partnership with Palantir). http://www.dailykos.com/story/2013/06/23/1218189/-HBGary-Pal... They appear to be offering a revolving door to high level government supporters who then later become "consultants" for the company. http://www.mausstrategicconsulting.com/topical-analysis-blog... "such as former head of the National Counterterrorism Center Michael E Leiter who had said to himself “There’s Karp with his hair and his outfit—he doesn’t look like me or the other people that work for me,” before becoming a supporter and then consultant for Palantir" and heavy lobbying (which explains some of the bizarre support they get in congress while the generals go blue in the face arguing against them) "It has also been active in formal political lobbying, recruiting former senators John Braux and Trent Lott, (5) with its lobbying expenditures increasing steadily from 2010 to 2013 when its total annual investment exceeded $1.1 million" more examples http://www.republicreport.org/2014/palantir-zach-wamp/ I've heard rumors that even the CIA is trying to distance themselves from them and find alternatives. reply eldamar 3 hours ago | link They essentially defrauded their chief competitor, i2, so that they could copy their features and reverse engineer their software so Palantir's system could integrate with it. Read the full complaint here for the juicy details: http://www.scribd.com/doc/36371667/i2-v-palantir-080910 Note that all the Palantir employees involved in this suit are still high-ranking Palantir executives. There is also the case of the Wikileaks/HBGary fiaso; the main individual involved in that mess is still a high ranking Palantir employee as well. reply Spooky23 4 hours ago | link I was involved in a Oracle Financials implemention a few years ago. Forget about the Oracle part... the IBM/Tivoli garbage used to monitor the IT systems cost about $1M in licensing alone! reply hkmurakami 5 hours ago | link They sure have chosen their preferred client industries of Government and Financial Services wisely then. Those industries (a) are accustomed to paying that much for their technology, and (b) are very unlikely to leave your platform once you start using your wares, since the difficulty of getting them as a customer in the first place (and how slow they move and how much paperwork / due diligence is required) directly translates to difficulty for them to move off of your system. Brilliant. reply elblanco 5 hours ago | link there's a fair amount of vendor lock-in in this space as well and Palantir is pretty good at it. They talk quite a bit about open standards and what not. But moving off of their platform and onto one of the competing ones is basically impossible. They've done a fantastic job at disrupting the link-chart market (which is surprisingly robust) and making it seem like customers are buying something else, but at 2-3x the price of the competition. They hide their sales guys as "forward deployed engineers" and obfuscate their sales process to the point where it doesn't seem like you've ever dealt with the kind of sketchy enterprise sales goon you'd deal with from any of their competitors. They're very smart. reply poolpool 8 hours ago | link Navigating enterprise sales cycles is a giant pain but man is it profitable compared to the latest social startup du jour. reply fishcakes 4 hours ago | link The alternative to Palantir - an alternative enterprise bespoke system or one built by the companies' or Gov's IT department - costs a whole lot more (25x) and often doesn't work! Palantir is a great value. reply elblanco 4 hours ago | link I presume you're talking about the DCGS-A system. Palantir has done an expert level job confusing the public on this. That system definitely has problems (it's terrible and sucks in many places), but it's a system of much larger capability and complexity than Palantir. Comparing Palantir to it is like comparing a wheel to a an entire transport system. Palantir could comfortably fit in as a single capabilty in DCGS-A (and probably do a better job than the stuff currently filling in that role), but it could never replace it. It's basically just a federated search, mediocre map and halfway decent link-analysis tool. But ask it to do anything even remotely outside of those three things and you're basically dead in the water as it doesn't offer anything relevant to all the other millions of things DCGS-A provides. DCGS-A is more than just some analytic tools. The reason it's not part of DCGS-A is very political and complex and as much Palantir's doing as the Army's, but the answer is that the components that are on DCGS-A that basically do what Palantir does were selected because they're cheaper over the long run, even if a bit clunky. For example, on the client side, there's presently a forward looking mandate from big Army to drop flash and java clients (because they're an IT administrative menace). Palantir's front end is Java. reply steakejjs 8 hours ago | link The question I am asking is, do they really have the demand to make $1.5million a customer pay (or look like one day it could pay) for their expenses? My guess is your estimates are really conservative. reply halcyondaze 8 hours ago | link Thanks for breaking that down. I was looking cluelessly at the price sheet for the actual prices. reply incision 9 hours ago | link All right in line with just about any sort of "Enterprise" software. Training and implementation services are downright cheap. Maintenance is the standard 20%. The last big vendor PO I had to look at put every professional services line item at $300-360/hr with $320 being about average. reply sien 9 hours ago | link Also Palantir's software actually does something more challenging than a lot of enterprise software. People should go and see what small packages from Oracle, HP, Tibco & IBM cost. It's incredible. reply elblanco 5 hours ago | link Funny you should mention that. Palantir's main competition in the governmeent, i2, is now IBM. i2 was selling their software at some fraction of Palantir's and in the DoD space it's basically as ubiquitous as Microsoft Office. Palantir is everywhere, but it doesn't end up being used nearly as much. reply meowface 6 hours ago | link Yep, absolutely. This is a perfectly reasonable price for good enterprise software that actually adds value to an organization. (God, I feel like a middle manager just by typing that...). My company spends tens of millions per year on some really awful enterprise software unfortunately. reply aliasaria 6 hours ago | link Favourite part: "Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien." reply jamesash 6 hours ago | link Funny, but necessary. The Zaentz company is notoriously litigious. From Zaentz' Wikipedia article: "In 2011, Zaentz's company began several legal actions against small businesses in the UK to enforce their "Hobbit" trade mark, including the Hungry Hobbit cafe in Sarehole, near Birmingham[13][14] and a pub in Southampton, England, which had traded as The Hobbit for twenty years.[15] This raised the ire of many British correspondents such as Stephen Fry, who described it as "pointless, self-defeating bullying." reply Jabbles 7 hours ago | link Agencies can browse GSA Advantage! by accessing the Internet World Wide Web utilizing a browser (ex.: NetScape) reply mikegreen 8 hours ago | link Do not confuse the GSA schedule with actual implementation cost (or TCO as mentioned below). The prices are a starting point and as with any relationship, they can (and will, if the buyer is smart) be negotiated. Source: sold & implemented alot of software for the gubbmint. reply hendzen 6 hours ago | link If you read between the lines, notice how the "Palantir Gotham Appliance" for 151,042.82 includes "Palantir recommended...database software licenses." I would bet Oracle (or MS/IBM) is getting a hefty chunk of that. reply mmcclellan 4 hours ago | link Yeah but it's only $10k a core more. This job posting lists Oracle and PostgeSQL: http://www.palantir.com/careers/OpenPosDetail?id=a0m80000002... reply dfc 4 hours ago | link I think it is Postgres. reply amalag 10 hours ago | link You can't do diddly with an off the shelf install. They get you on the Implementation Ninjas and Support. reply elblanco 5 hours ago | link Their implementation periods are horrendous. Their marketing speak and sales drones make it sound like a turnkey appliance...like you just drop it in, point it to your database URLS and you're now playing with knowledge management. But in practice there's months of custom backend Java development (the entire tech stack is Java 1.6 or something horrible) to build the connectors and map the data into their backend, then months of ontology management meetings to build up the one-true-model (TM) for all your enterprise needs. Then months and months of post deployment tweaking and continuous work to keep the system alive and fix issues when some of the data sources change schemas or something. I've heard things like average time from purchase to full deployment is something like 9 months. But from my time dealing with them I think it's much longer. reply fishcakes 4 hours ago | link That is simply FUD – Palantir guarantees to customers that their software is working within 90 days AND has generated results. They offer a refund if not. Their homepage said this for a while! reply elblanco 4 hours ago | link Well, feel free to buy a core and let me know how long it takes before you're up and running. Having been on the inside during 3 of their deployments, and on the outside of 2 more, I can definitely say 90 days is wildly optimistic. edit never mind, after reviewing your comment history, it looks like you probably work for Palantir. You should probably disclose that. I stand by my comments about deployment times. reply capkutay 9 hours ago | link I think they get you on the off the shelf price too.. $150k/core...say you run it on a cluster of relatively puny machines ...($150k * 4 cores) on a 4 node cluster is already above $2m. reply dlinder 7 hours ago | link 132-51 CONS CONUS FSR Support hourly rate. CONUS rates will be billed for Services performed outside the continental U.S. unless in a warzone. Normal business hours are defined as an 8-hour work day (rate is 15% more outside of normal business hours). $ 146.60 132-51 OCONS OCONUS FSR Support hourly rate. OCONUS rates will be billed for Services performed in a warzone. Normal business hours are defined as a 12-hour work day (rate is 15% more outside of normal business hours). $ 195.47 reply bane 7 hours ago | link I'm actually surprised how cheap their OCONUS warzone rates are. Many contractors will pay hazardous bonuses, time in theater bonuses and living condition bonuses on top of the CONUS base pay. Added up it can far exceed this kind of rate. But this is probably helpful for people getting into consulting to see what hourly rates are for this kind of work. In my experience these rates are actually fairly cheap. I'm used to seeing $170-200 for most things billed to the government. But I've also heard Palantir has fairly conservative pay caps, that might account for the low rates. reply judgardner 10 hours ago | link 132-51 | IMS | Implementation Ninja Services reply dkarapetyan 9 hours ago | link So ost. reply bane 6 hours ago | link It's less automated data analytics and more chart drawing and semantic knowledge base management tied to a federated search system. Their principle competitor is http://www-03.ibm.com/software/products/en/analysts-notebook They used to have a free trial you could run via java webstart on their website, but they've taken it down. Here's a video https://www.youtube.com/watch?v=f86VKjFSMJE It's big data in the sense that using google's search box is big data. But from my time using their demo a couple years ago, the actual tool is fairly small in focus. I don't even think the chart view can show more than a few hundred things. reply mayneack 2 hours ago | link It's still up: https://analyzethe.us/ reply bane 1 hour ago | link Oh okay cool. That's a different demo. The old one was Operation Tradewinds or something. reply mayneack 1 hour ago | link Tradestop is what you're thinking of. reply AJ007 5 hours ago | link Interesting, it looks a lot like Maltego. reply fishcakes 10 hours ago | link Pretty affordable considering many other things on the GSA don't work once you buy them! reply jonknee 8 hours ago | link Luckily for Palantir whether or not it works is classified. I have my doubts. I'm sure it "works", but I'm also sure it's a giant waste of money and Americans are not safer because we're funneling millions of dollars to Palantir. reply bane 6 hours ago | link I messed around with the demo they used to have on their website. It seems to be very much an answer to the 9-11 failure to connect the dots problem. Unify search, build semantic links. It was a very manually intensive tool based on what I saw. Very little automation, more like those pictures and strings you see in crime shows on TV...but on a computer. reply arikrak 7 hours ago | link How do they get such precise prices? If I was selling something for 140k, I would sell it for 140k. But they sell it for $141,015.42. reply pvarangot 6 hours ago | link It's GSA price. My guess is the retail price is somewhat rounder, and after tax and other specific discounts it comes down to that. reply m0nastic 5 hours ago | link Strictly speaking, being on the GSA schedule and being able to offer products/services for sale to the federal government requires that you not sell that product/service anywhere else for less than that GSA price. This is actually one of the reasons that doing business with the government is less lucrative than the commercial industry (for products and services which are comparable, many are things only sold to the government, so there is no hesitation about pricing them through the roof). As you can imagine, one of the ways that duplicitous federal contractors get around the idea of having to sell to the government for less than their normal prices is to structure their products/services as different (and therefore not apples to apples comparable). I still would bet that the price that they charge Goldman Sachs (just as an example, I don't actually know which investment banks are using their product) is higher than what they charge for any individual government client. Also, I think it's probably worth noting that the maximum addressable customer base for their products for federal agencies is way smaller than the equivalent number of financial customers. There's really only a handful of agencies that have this capability (I'd guess more than a handful, but probably less than a dozen). reply tptacek 6 hours ago | link Yes: GSA prices are IIRC the result of a pro-forma (and totally BS) discounting process. reply phmagic 10 hours ago | link pretty affordable compared to most enterprise software packages reply bicknergseng 10 hours ago | link "per core" reply trhway 9 hours ago | link with 90 days warranty :) Can it rot? Anyway, from their Gotham page https://www.palantir.com/palantir-gotham/ "Working closely with the customer, our engineers integrate and map all of the relevant source data—regardless of type or volume—into a single, coherent model. ... Once the model has ted, data flows continuously from its sources into the Palantir Gotham platform. ... They can search across all of their data sources at once, visualize relationships, explore divergent hypotheses, discover unknown connections, " Pretty much my 2009 pitch, and in the hindsight i see that my main weakness was that i couldn't even imagine $150K/core. Man, it is imagination what separates losers from winners! :) reply sz4kerto 8 hours ago | link kdb, a database engine I consider extremely simple compared to Palantir costs $50k/yr/core. reply mmcclellan 4 hours ago | link simple but competent for time series. and the 32-bit version is at least available for free now. reply xacaxulu 8 hours ago | link So Palantir is hiring if you have a clearance :-). Time to get your tax dollars back. Looks like SAIC all over again. reply xamdam 6 hours ago | link You don't need a clearance. We have large commercial deployments. reply bane 4 hours ago | link I did some consulting work with the NYPD and heard you guys also have some deployments with them and other large police forces. Those are nice non-clearance, but cool, jobs as well. reply

1 0

Apple Tim Cook re NSA etc on Charlie Rose
by grarpamp 17 Sep '14

17 Sep '14

http://www.zdnet.com/apple-ceo-tim-cook-on-snowden-surveillance-sweatshops-… http://www.zdnet.com/apple-ceo-tim-cook-on-secret-products-steve-jobs-ibm-d… http://charlierose.com/

2 1

Fwd: [liberationtech] proof of tampering
by coderman 16 Sep '14

16 Sep '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Tue, 16 Sep 2014 14:26:50 -0700 Subject: Re: [liberationtech] proof of tampering On 9/16/14, Jonathan Wilkes <> wrote: > ... over a year after the initial Snowden-leak stories-- I'm curious if > anyone has references to articles or papers that have researched and > reproduced any of these exploits to show how they are used in practice to > steal data, surveil, etc. it is very difficult finding detailed, public research into this particular type of offensive reversing. public knowledge is constrained by: - lack of access. see list history regarding ability to even detect/observe the most advanced attacks. this is changing, however. c.f.: exposure of corporate level, middle school type contract kit: https://wikileaks.org/spyfiles4/ and the work of Morgan Marquis-Boire. The Stuxnet/Flame/Guass/Duqu/Skywiper/Mahdi analysis are still the only views of TAO/NSAlike campaigns. corrections welcome ;) - lack of skills+/-experience spanning domains required to dissect the attack across its many pivoting boundaries of enabling and transiting through hardware, devices, networks, and systems under attack. [a redditor could do a shiny graph showing how nearly every technologist with the expertise for world class malware analysis ends up under secret contract, private contract, or does something else outside of university, to varying proportions of each.] - lack of interest or time; the small subset left in consideration is only human, and a thorough reverse analysis of complex stealthy code eats your life in quarter or full years chunks. a passion for the subject only carriers so far... finally, to underscore the point as is so conveniently at fingertip, your mail immediately went to the spam trap, having violated who knows what in googbrain to indicate forgery or malicious intent. why aggressively stamp down a narrative when you can slowly bleed it into silent not-existing instead? good luck, and best regards,

1 0

Assange AMA on Reddit
by Eugen Leitl 16 Sep '14

16 Sep '14

https://www.reddit.com/r/technology/comments/2ghp54/i_am_julian_assange_ama…

2 1

About STELLARWIND and other mysterious classification markings
by coderman 15 Sep '14

15 Sep '14

http://electrospaces.blogspot.nl/2014/09/about-stellarwind-and-another.html [ ... a good read; go do so now! ] for the TL;DR crowd: """ In the end, it doesn't make much difference whether STELLARWIND is a control system on its own, or a sub-system of COMINT, but it is remarkable that for such an important program, the people involved apparently also weren't clear about it's exact status and how to put it in the right place of a classification line. More important though is that the declassified documents show that besides the STELLARWIND program, there's at least one COMINT-compartment with at least one sub-compartment that protect similar or related NSA collection efforts which are considered even more sensitive, but about which we can only speculate. """

1 0

Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks
by coderman 15 Sep '14

15 Sep '14

direct draft at: https://www.rfc-editor.org/rfc/rfc7359.txt -------- Forwarded Message -------- Subject: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Date: Tue, 26 Aug 2014 18:23:00 -0700 (PDT) From: rfc-editor(a)rfc-editor.org Reply-To: ietf(a)ietf.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: drafts-update-ref(a)iana.org, rfc-editor(a)rfc-editor.org A new Request for Comments is now available in online RFC libraries. RFC 7359 Title: Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks Author: F. Gont Status: Informational Stream: IETF Date: August 2014 Mailbox: fgont(a)si6networks.com Pages: 12 Characters: 26506 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-vpn-leakages-06.txt URL: https://www.rfc-editor.org/rfc/rfc7359.txt The subtle way in which the IPv6 and IPv4 protocols coexist in typical networks, together with the lack of proper IPv6 support in popular Virtual Private Network (VPN) tunnel products, may inadvertently result in VPN tunnel traffic leakages. That is, traffic meant to be transferred over an encrypted and integrity- protected VPN tunnel may leak out of such a tunnel and be sent in the clear on the local network towards the final destination. This document discusses some scenarios in which such VPN tunnel traffic leakages may occur as a result of employing IPv6-unaware VPN software. Additionally, this document offers possible mitigations for this issue. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/rfc.html Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

SpyFiles 4
by coderman 15 Sep '14

15 Sep '14

"Today, 15 September 2014, WikiLeaks releases previously unseen copies of weaponised German surveillance malware used by intelligence agencies around the world to spy on journalists, political dissidents and others." - https://wikileaks.org/spyfiles4/index.html get it while it's hot!

1 0