Forgot your password?

Comment: Random thoughts (Score 1) 361

DUAL_EC_DRBG was a random number generation algorithm that only its mother could love. It's slow, complex not provably more random than other algos, and comes with magic, unexplained constants, which are the last thing you want to see in an ostensible entropy generator based on asymmetric crypto... and if you want FIPS certification you have to use the given constants. Why did NSA want it in there so badly? Why, after a potential flaw was found and corrected, did NSA personnel "suggest" a change that, in retrospect, only made that putative flaw more reliably exploitable? Cryptologists explain.

On the hardware side, Theodore T'so observed that Intel was very eager to have RDRAND be the exclusive source of entropy for the kernel's RNG, as was one goofball at Red Hat who tried to introduce a kernel parameter to do the same thing. He fought them both off, thankfully.

In general, see also ProPublica on the SIGINT Enabling Project.

Comment: "I hunt sysadmins" (Score 1) 361

I Hunt Sysadmins discusses why sysadmins are high-value targets. In short, sysadmins are often softer targets than the high-value Linux systems they might be paid to secure or administer. They probably use webmail or social networking services from PRISM partners, and the things they look up often reveal information about their projects and methods. The thrust of it is how to look at haystacks with CT technology instead of boring old flat radiographs, and as odious as the ends are, the means are the stuff of a fascinating, occasionally scintillating read. They are, after all, just a very large IT shop with a one-of-a-kind data set to play with.

Of course the haystack analogy breaks down before it starts as there is no +1 Needle of Revealed Wisdom to locate and extract. Is Russia fomenting a "color revolution" in the US as payback for the two we gave them in Ukraine? Is China building a fifth column inside the US to ensure their trillions in dollar holdings will hold value? Is French heavy industry spying on major US political patrons and stealing intellectual "property" or business information? Does Germany still believe the USA is faithfully holding all their gold on deposit at Fort Knox? Is Elizabeth Warren really a danger to foreign investors favored by the ruling class? etc.

If you think situational awareness is a waste, you're probably forgetting that government organizations can provide good service to customers iff the government thinks it's important. City hall treats you with hostility not because they're the government, but because you're not.

Comment: Speed limits are perfectly rational (Score 1) 361

as a means of keeping the working class obedient and docile and paying for the middle class. They are also rational from a safety perspective. The devil (or the intent to exploit, if you prefer) is in the details.

The mistake is assuming that the ancien regime exists to serve you, which is not only laughably ahistorical, but nauseatingly consumerist. Unless you're part of the gentry, you exist to serve them.

Comment: Ah, ah, sources and methods (Score 1) 361

Rays can be traced both ways. Each bit of intelligence gathered provides information about how and whence it was collected. That's not the sort of thing you throw around casually unless you're trying to burn it. (See also "parallel construction".)

Besides, why would they when GCHQ's already got a whole company of Internet trolls to run propaganda ops (or as they call them, "Internet effects operations") and outsourcing makes for cleaner hands and more deniability?

Comment: Re:Well, of course (Score 1) 361

what they don't realize is the more they do this shit, the more they'll create extremists.

How do you know that they don't? C'mon, systems thinking (or even murder thinking): for which agents in the system is that outcome a win (motive)? Who is equipped to pull it off (means)? Who has the political capital to put such a thing through without mass disobedience (opportunity)? Or, forget that, and just look at the USA's documented habit of quietly funding, arming and training a new flavor of fundie (ISIL, 2012, Jordan) to break down working secular governments so Grover Norquist can drown them too in a bathtub and steal the hydrocarbons from under them.

Static analysis is useless in politics. Assume every word or act from every authority figure is an attempt to exploit until proven otherwise. (If infosec were a high school graduation requirement, this consumer politics of jousting with pool noodles would collapse instantly.)

Comment: Re:Underlying cause? (Score 1) 361

It was also well-documented after WWII that there was a powerful network of industrialists trying to defend their privileges in capitalism, and that the John J. Birch Society was a creation of the same Koch family that bankrolled climate denialism and the Tea Party movement.

If we're going to play G-d and hand out deserts, you're right, Alyssa Rosenberg did deserve to be executed (but, sadly, wasn't).

+ - NSA Considers Linux Journal Readers, Tor (And Linux?) Users "Extremists"

Submitted by marxmarv
marxmarv (30295) writes "If you search the web for communications security information, or read online tech publications like Linux Journal or BoingBoing, you might be a terrorist. The German publication Das Erste disclosed a crumb of alleged XKeyScore configuration, with the vague suggestion of more source code to come, showing that Tor directory servers and their users, and as usual the interested and their neighbor's dogs due to overcapture, were flagged for closer monitoring. Linux Journal, whose domain is part of a listed selector, has a few choice words on their coveted award. Would it be irresponsible not to speculate further?"

Comment: Re:Fsck x86 (Score 1) 230

by marxmarv (#47200515) Attached to: Intel Confronts a Big Mobile Challenge: Native Compatibility

"they won't be designing the same thing 50 times. See that's the ARM markets biggest handicap, there are dozens of companies reinventing the wheel over and over again."

They aren't inventing squat. They're taking a soft IP core processor provided by ARM and connecting their own pieces up to it, same as any other SoC or S-100 computer. No testosterone-drunk manly geek auteur nonsense, just instantiating, wiring, simulating, taping out and profit. Buying that three-year head start from ARM was a good idea for them.

Get yourself a book on Verilog or VHDL and build yourself a couple of toy SoCs using IP from OpenCores. If you're feeling really adventurous, borrow the Hennessey book from someone at work and design your own processor. Really, if you're gonna fanboi, at least know what you're fanboi-ing about.

Comment: Re:Since Mozilla decided... (Score 1) 403

It wasn't Mozilla. It was the liberal-capitalist community that needed a good witch-burning to take well-meaning minds off real, general quality-of-life issues and onto specific quality-of-life issues. Since the bourgeois LGBT contingent has sold out the queers and other subaltern groups, they can easily be led (as we all can) to play LGBT Moral Majority for some other richie. Why, some day, they might be the richie leading the charge! But that's group dynamics for you: ideologies and religions require belief in some unprovable fact as the price of admission. Otherwise, they'd be all the same, and how would groups differentiate each other if they were all just human without pretense or artifice?

Anyway... the LGBT-and-allies community consists of a lot of people; they've got a powerful, established institutional infrastructure (see also Dan Savage, nouveau Democratic boss, quacking in time with the Adminstration about Russia in 2013); they believe they are motivated and informed by principles but in fact succumb to hermeneutics and peer pressure as they become insiders; they're broadly perceived as motivated by principle; they've had their morale managed over the past few decades to a just-sufficient level to stay hungry; they desire to be accepted as part of mainstream society; they're ignorant of what, who, where and why power (the ability to achieve planned outcomes) is; and they like all humans are easily led (the ones who think they're too sly for it are among the easiest).

So they're a natural, powerful and pre-paid covert militia for the business interests of the Democratic Party, playing the mirror role to Protestant Christians are the natural, powerful and cheap covert militia for the business interests of the Republican Party.

Comment: Better.... or worse? (Score 1) 403

It's not safer, necessarily. The EME module is most likely delivered as a native binary; therefore the syscall interface is still available and the usual errors prevalent in dealing with structured data are still possible. To trust Adobe in any case is clear evidence of peasant desperation and/or paternalistic delusion.

When they come for the div tags, don't call me for help.

"You don't go out and kick a mad dog. If you have a mad dog with rabies, you take a gun and shoot him." -- Pat Robertson, TV Evangelist, about Muammar Kadhafy