Re: [Cryptography] actual journalism, was LRB article, Satoshi's Trump Card

2017-07-03 Thread James A. Donald
On 03/07/2017 4:31 PM, Ben Laurie wrote: Confused by this - Merkle trees inherently don't grow to enormous depth. The bitcoin hash chain grows to enormous depth, and arguably it is a Merkle tree that testifies to all transactions everywhere that ever taken place in bitcoin. If you say it is

Re: [Cryptography] actual journalism, was LRB article, Satoshi's Trump Card

2017-07-03 Thread James A. Donald
Confused by this - Merkle trees inherently don't grow to enormous depth. I am pretty sure that if I give a definition and say "A Merkle tree is such and such", a bikeshed war will ensue over my definition of Merkle tree, which war will probably result in Perry blocking my posts. So let me de

Vulnerability of OpenSource Software download mechanisms: VLC

2017-07-03 Thread Fabio Pietrosanti - Lists
Hello, as we move to improve the status of encryption of the internet and at all levels internet companies diffuse the uses of HTTPS encryption and integrity protection methods there are still a variety of massively diffused pieces of software that can be subject to malware injection trough MITM t

Re: Vulnerability of OpenSource Software download mechanisms: VLC

2017-07-03 Thread Steve Kinney
On 07/03/2017 08:36 AM, Fabio Pietrosanti - Lists wrote: > Hello, > > as we move to improve the status of encryption of the internet and at > all levels internet companies diffuse the uses of HTTPS encryption and > integrity protection methods there are still a variety of massively > diffused pi

Re: Vulnerability of OpenSource Software download mechanisms: VLC

2017-07-03 Thread Bardi Harborow
All of this is well and good as long as we remember that digital signing of anything only provides security in processes which verify the signature. Installation through Linux software repositories verifies the signature. Installation on Macs verifies the signature provided the user does not click

Re: Vulnerability of OpenSource Software download mechanisms: VLC

2017-07-03 Thread Sergey Matveev
*** Steve Kinney [2017-07-03 17:30]: >> However they are refusing to implement HTTPS arguing that because their >> .exe are digitally signed with authenticode they are safe >> https://trac.videolan.org/vlc/ticket/18472 . > >Against hostile State actors, HTTPS only provides a false sense of >secur

Re: Vulnerability of OpenSource Software download mechanisms: VLC

2017-07-03 Thread grarpamp
Using videolan purely as representative example... Here are some keys... https://download.videolan.org/pub/keys/ https://keyserver.siccegge.de:11371/pks/lookup?search=0xE58D1ADC&fingerprint=on&hash=on&op=vindex Their main app is signed. But like most orgs, they still think unsigned '.md5 / .sha1'

Tails prevents MAC changes as design feature

2017-07-03 Thread didukno
I have issues with network interfaces, like wlan0, changing back to what the system wants. This is not what I want. Case: - Start Tails (MAC Address Spoofing: On) - Plug in network card (wlan0) - macchanger assigns wlan0 random MAC string - Bring wlan0 down - Set new MAC string (macchanger or o