[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJVRA1SJXFLYhqDn+2qqa2OWT=CrghgH7MnG7bzU5ufMhngi9A@mail.gmail.com>
Date: Thu, 20 Mar 2014 08:38:43 -0700
From: coderman <coderman@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: FD mailing list died. Time for new one (or something better!)
specifically you are building hardened, reproducible pkgs/isos from snapshots of
- live Qubes OS for baremetal layer
- tails, whonix, kali, arch, ramfsonly variants, exotics per all reqs
- ENTROPY DONE RIGHT, END TO END, FROM DEVELOPER COMMITS TO RUNTIME GUESTS
^this is capitalized because after decades of seeding crypto laughbly wrong,
we're still routinely making laughably wrong seeds, everywhere...
i am getting desperate!
,see also:
http://blog.cryptographyengineering.com/2014/03/how-do-you-know-if-rng-is-working.html
- the bootstrap client is built for native platforms to retrieve over
various means for linux32, linux64, osx32, osx64, win32, win64,
android, iOS, windows mobile which deploys the hardened bare metal
systems with scrutinized builds above
OH: "duuuuude, don't do it. no. don't. no no no."
'cmon, :) how long have you wanted to see a nice weaponized
pre-auth ssl+escalate drop? :) :) :)'
"not funny! these are operations nightmares you fucker!"
Q: "I heard infosec is dead. the citation was infosuck as definitive.
#oldtimers and stuff"
A: i don't know shit, but one thing i do know is:
if your hacker peer group is this bad and/or one of the 1:4
malicious entrapping snitches and/or ALL got v8nd doing stupid shit
while high on stupid shit making stupid judgement calls and/or
otherwise failed to be decent humans
- then you're doing it wrong!
good news it is not too late to make good friends and get over your
bullshit ;)
[in all seriousness, it's an amazing time to be alive! the
unappreciated work that is being done is everywhere if you make an
effort to seek it out.]
Q: "How big could such a bounty/bet get?"
A: if i was the CIA i would take the snowden docs that are eventually
after 42 years or so disseminated in full and dump them to the hidden
fuller disclosure. drop a few TAO 0day expected to lose utility on the
list as false flag. use it to grind some axes through
SUBQUANTUMSQUIRRELMESH cover and use pilfered bounty to bet against
the opers driving "perceived risk of running hidden site" to level
'wutsohigh'. then i'd use black funds stoking social media fire storm,
the righteous furor pre-disposing the public to zero sympathy for what
follows. nulling the meatbags simple as identities strategically
leaked for hidden disclosure service operators to "lower american
clandestine chemical cleaners" for prompt chemical dissolution. the
subsequent narco pulp tie up bolsters pre-seeded notions that said
"criminal hacker terrorists working for foreign intelligence services
conspiring to kill americans with logic bombs thrown from darknet
intertubes" deserved righteous death by sword clearly, if not for this
narco deal then surely for <insert 3-5 favorite fad horsewomen here
for straw beating>.
finally, having driven the bounty on the hidden disclosure service
to an absurd level twice the GDP of china, i would dump and mix the
coins to a hidden wallet and disappear into history, never to be seen
or heard from again.
TL;DR: the pot could be twice the GDP of china
if the CIA is playing the game with us and feeling extra dirty.
[ 35 yrs later: the fact this was an exceptionally compartmentalized
black op is quietly noted along with a few hundred thousand other
arcane dumps no once cares about anymore... also un-noted: this
operation was 100% sucessful in scaring all the fear cowed whitehats,
grayhats, blackhats and inbetween from ever thinking about operating a
truly fully disclosing forum for communication in the modern world.
times have changed you hacker punks! ]
Q: "When I asked if this could get any further off-topic, I was
lamenting - not challenging!"
A: hey, i'm not the one who is slacking on the disclosure of the
hidden disclosure service!
i just expand the anonymity set here...
FIN: really done on this subject. if you're actually curious and
willing to volunteer time and testing, go off-list and on-crypto :)
https://peertech.org/files/0x65A847E7C2B9380C-pub.txt
current OTR 157B7040 4339EFCA D83EF33D 7064F401 843A7E98
https://peertech.org/files/otr.txt
View attachment "0x65A847E7C2B9380C-pub.txt" of type "text/plain" (3264 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
