- cypherpunks@lists.ogf.org

Re: hacker != cracker (Re: Swartz, Weev & radical libertarian lexicon)
by coderman 20 Jan '14

20 Jan '14

On Wed, Jan 8, 2014 at 6:04 PM, brian carroll <electromagnetize(a)gmail.com> wrote: > coderman wrote: >> i am exploring a gambit for disclosure post-statute-of-limitations, >> but even this protection seems meager and risky. > > (that is a beautiful idea) it may be a very bad idea, we'll find out together these months ahead ;) there are three tales to tell: the first: wifi security interests crossed paths with power institutions lacking tact. 2003 Synopsis scanned and vulnerable, Synopsis providing licensed IP to Intel, the Oregon behemoth, who then combined a PR ruse[0] with InfraGard pull for a FBI fishing expedition trying to catch dirt... the second: monitoring from convenient location unexpectedly colocated by covert crash pad for $TLA adventure leads to lessons on mutual authentication assurances. the third: a "research experiment" widely talked about yet so few know about. in 2007 a confluence of factors collided in the perfect storm: a Tor privacy appliance actively thwarted by VMWare, a Tor summer of code proposal rejected with prejudice, and a rash of mediocre Tor vulnerability papers garnering press and pomp for posturing poseurs. under this cloud of discontent we discovered and maximized a control port vulnerability to demonstrate both the inherent strength of a virtualized transparent proxy model, but also just how bad a truly a truly bad vulnerability can be in practice. (dialed to 11, and discovered the unbelievable without getting disappeared ;) in each a discussion of the security lessons learned, perhaps an insight here or there, much rambling implicitly entwined... that will do for now, until the future, best regards 0. called for lengthy discussion as background on article for wireless security, instead used as a scaryhacker caricature in FUD piece promoting Intel Centrino security features. never talked to media since; encourage all to never talk to media as well with rare exception. specific quote behind the interest: "Netstumbling is not against the law, says special agent Mary Kimura of the Federal Bureau of Investigation (FBI), but it comes awfully close. "It's not illegal to scan for open networks," Kimura says, "but once a theft of service, denial of service, or theft of information occurs, then it becomes a federal violation." Kimura is the Infragard coordinator in the FBI's San Francisco office."

1 1

cypherpunks and hackers who dont code?
by Anonymous Remailer (austria) 20 Jan '14

20 Jan '14

to the inmates: its seems we have a number of the intellectually lazy among us who either dont/wont or in some way refuse to code.. yet they wish to call themselves cypherpunks and hackers. am I missing something here about these wannabe(s)

8 12

Fwd: Debian System and /dev/random
by coderman 20 Jan '14

20 Jan '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sun, Jan 19, 2014 at 4:57 PM Subject: Re: Debian System and /dev/random On Sun, Jan 19, 2014 at 11:41 AM, Jeffrey Walton <noloader(a)gmail.com> wrote: > I'm working on a laptop with quad core i5 running Debian 7.3 x64 > (fully patched). > > You know this damn thing was running out of entropy in /dev/random > because no entropy daemon was installed out of the box.... since 2004 building my own rngd, my own FDE bootloader, my own mandatory entropy health watchdog service, in every distribution: none did FDE key management right (for loop-aes at the time), none did entropy right. in 2008 various "expert install" console only options began to support a suitable FDE solution with luks and boot by volume GUID (rather than device file). many years we've had full blown easy (for some degree of easy) FDE solutions in graphical installers out of the gate. progress! and yet entropy, the most critical component of any crypto system, is so horribly and woefully inadequate today. will no indications this will change soon... this is not an accident. :/ > And I was depleting it with a simple program that tried to read 32 > bytes to seed an OpenSSL generator. I could only get 9 or 16 or 19 > bytes out of it yup. for fun, check out how this setup seeds itself: https://github.com/catid/cymric/ """ Linux/Android: /dev/random (160 bits) /dev/urandom (96 bits) srand() and rand() from stdlib (64 bits) gettid() or pthread_self() (32 bits) getpid() (32 bits) Linux-type systems are a little strange in that /dev/random only keeps about 20 bytes of entropy in reserve. And it takes roughly 20 seconds for a VPS to collect 8 bytes of entropy, which means asking for 32 bytes of entropy takes an unreasonably long time. By asking for only 20 bytes, most of the requests by this library will complete immediately. And the remaining 12 bytes are satisfied by /dev/urandom... """ > Seriously... That's all it was on startup.... > > That's amazing in 2013........ amazingly effective! BULLRUN FTW [EDIT: to clarify, i am lamenting the lack of high rate, raw source physical entropy sources as native instructions in processors. this should be a baseline mandatory requirement! i am also lamenting the lack of user space entropy daemons and collectors being enabled by default in most distributions. i am also lamenting the lack of proper boot time / VM pass through entropy support in most distributions. i am lamenting the lack of any failure handling for entropy in any distribution, such that a failed RNG condition leads to service halt rather than blindly carrying on, perhaps for years, unaware that you're broken. i am also lamenting the lack of serious attention and thoroughness applied to entropy sources in nearly every computing system deployed across this planet. i could go on, but you get the point... *grin* ]

1 0

test 1a
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

this is a test of remailer white listing

1 0

"the ability of the government to go back to taps collected years earlier to look for material with which to influence potential witnesses in the present"
by coderman 19 Jan '14

19 Jan '14

see also: http://www.reddit.com/user/ellsbergd from thread: http://www.reddit.com/r/IAmA/comments/1vahsi/i_am_pentagon_papers_leaker_da… --- PulvisEtUmbraSumus When did you first become aware that there had been an attempt to seize your medical files from Lewis Fielding's office, and what was your reaction to the administration going that far? In general, how aware were you of surveillance and character assassination attempts against your person, such as the attempts to tie you to communist groups in Minnesota as per this conversation between Nixon and John Mitchell? --- ellsbergd WOW! That link is absolutely fascinating! (Even though I don't have the time just now to go through it in detail, as I will shortly). Thank you for the link! I have to ask, where is it from, where did you get it (on the White House transcripts)? Well, in answer to your question, I just became aware of some surveillance on me (BEFORE the Pentagon papers came out) ten minutes ago, from your link. I was being surveilled because I was a witness in a criminal trial of draft resisters, some of the Minnesota Eight. Their very good lawyer has been accused, I don't know on what basis, of having been a Communist. And that allegation was not of particular significance to the DOJ UNTIL, months later, he was associated with me, after the Papers came out. Likewise, the president is heard discussing with Haldeman on these transcripts the need to go back over earlier (illegal, warrantless) wiretaps--of journalists and White House officials, on which I was overheard--to see what might look significant now, in light of the release of the Pentagon Papers. That's what I've been talking about in earlier answers: the ability of the government to go back to taps collected years earlier to look for material with which to influence potential witnesses in the present. (See their interest in the allegation that the wife of one journalist may have been accused of shoplifting in her past). So people who have "nothing to hide" should ask themselves if that is equally true of their spouses or children, or neighbors, who could possibly be turned into informants by threat of their private lives being revealed. (The Cuban CIA assets who burglarized my psychoanalyst's office were interested in my children and wife as much as me, a reporter who interviewed them was told; they had been told of the precedent of Alger Hiss' step-son who was crucially deterred, at Hiss' insistence, from testifying in his defense at his trial on a crucial point, because he would have been questioned about his alleged homosexuality). My analyst later apologized to me for not telling me about the break-in--which he was sure was aimed at me, by the White House--because his lawyer had advised him not to "get involved." So I didn't know about it until it came out in my courtroom, thanks to John Dean's revelation. All for the best. If he had told me and we had raised it in the court-room, the plumbers would not have been kept on the White House payroll (via CREEP) and would not have been ordered into the Watergate. Nixon would have stayed in office, and the war would have continued for years.

1 2

Updates on the Death Prediction Lottery.
by David - 19 Jan '14

19 Jan '14

Some updates to DPL. 1) I have added a lot of names, mainly FISA court members and people from intelligence agencies. 2) I have decided not to have multiple pools but to have every name in the same death pool. Most names qualify for 75% of the pool funds, a few for 100%. The list is not complete yet, and I would consider any suggestions that I might receive. D.

5 10

Re: Updates on the Death Prediction Lottery
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

Good work with the DPL! I visited the site a few weeks ago and saw it was coming along very nicely. I do have a concern about buy-in costs though. Are you planning on ever lowering the costs to cheaper than 1 bitcoin? At the current price, many can't afford to make a prediction. If you lowered, more people would participate and the pool would grow larger, more quickly. Just a thought. On 01/18/2014 06:26 PM, David - wrote:> Some updates to DPL. > > 1) I have added a lot of names, mainly FISA court members and people from intelligence agencies. > 2) I have decided not to have multiple pools but to have every name in the same death pool. Most names qualify for 75% of the pool funds, a few for 100%. > > The list is not complete yet, and I would consider any suggestions that I might receive. > > D. > >

2 1

test 3
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

t 3

2 1

TROY BENJEGER TRIES TO GET IN PROFESSIONAL VICTIMS PANTS
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

and your angling to get in the professional victims pussy is obvious.. whats the matter cant make the bad persons stop telling the truth about your girlfriend? fuck you troy benjeger cock blocking anonpeople ps you give cypherpunks a bad name... pussy

2 1

AHEM! Please dont feed the Troll(s)!
by Anonymous Remailer (austria) 19 Jan '14

19 Jan '14

Sigh, seems every crop of new cypherpunks has to learn this lesson. Folks, Please DONT FEED the trolls here on cypherpunks.. dont repeat their subject lines dont respond to them, ignore them and killfile them if possible so you are not tempted to respond to them. Trust me its like wrestling with a pig in shit. after a while you notice the pig is enjoying him/herself. Anything you tell a troll will be used as more fuel for the fire.. trust me I have seen this many times! the anon moderator

3 2