Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of zikula.org
	designates 74.125.82.175 as permitted sender)
	client-ip=74.125.82.175; envelope-from=drak@zikula.org;
	helo=mail-we0-f175.google.com; 
MIME-Version: 1.0
In-Reply-To: <20131212205106.GA4572@netbook.cypherspace.org>
References: <52A3C8A5.7010606@gmail.com>
	<1795f3067ba3fcdd0caf978cc59ff024.squirrel@fruiteater.riseup.net>
	<52A435EA.7090405@gmail.com> <201312081237.24473.luke@dashjr.org>
	<CANAnSg2OrmQAcZ+cZdtQeADicH3U29QOgYPfP1AQhOMP6+P1wg@mail.gmail.com>
	<CAAS2fgR0khyJxmz9c2Oc87hOFgiNuiPJuaeugGajdo_EcKEW9w@mail.gmail.com>
	<20131212205106.GA4572@netbook.cypherspace.org>
From: Drak <drak@zikula.org>
Date: Tue, 31 Dec 2013 13:39:30 +0000
Message-ID: <CANAnSg3nPhrk2k=yDKf39AuBQnSuTWJbgANdMhGe=soiOy0NTw@mail.gmail.com>
To: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Content-Type: multipart/alternative; boundary=e89a8f3bac6fcb8e8d04eed4b1ed
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org,
	your thoughts?
Precedence: list

--e89a8f3bac6fcb8e8d04eed4b1ed
Content-Type: text/plain; charset=UTF-8

Has anyone seen the talk at 30c3 on the current NSA capabilities?
https://www.youtube.com/watch?v=b0w36GAyZIA

Specifically they are able to "beat the speed of light" between you and a
website such that if you communicate with Bob, they can sent competing
packets that will arrive before Bob's packets. They have  realtime deep
packet insertion able to inject arbitrary data into an TCP streams and can
change file downloads **on the fly**. This can be done remotely.

Sourceforge do not have https downloads, so this is yet another reason to
move downloads to somewhere that does - like github.
The NSA has the ability, right now to change every download of bitcoin-qt,
on the fly and the only cure is encryption.

Revealed as part of the presentation is the fact that if the NSA has access
to these capabilities, then so do others and in fact one of the things
revealed yesterday was independently discovered already and published.

Same goes for the bitcoin.org site - why are we dragging our feet on
installing an SSL certificate and redirecting all http to https? While no
solution is perfect, it's a lot better than zero defense.

You can see the irony of disseminating the bitcoin crypto-currency client
 in the clear.

For anyone who has not seen the video. You will be shocked by what is
actually in the wild being used today. It goes way beyond anything
imaginable even in science fiction.

https://www.youtube.com/watch?v=b0w36GAyZIA

Drak

--e89a8f3bac6fcb8e8d04eed4b1ed
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Has anyone seen the talk at 30c3 on the current NSA c=
apabilities?=C2=A0<a href=3D"https://www.youtube.com/watch?v=3Db0w36GAyZIA"=
>https://www.youtube.com/watch?v=3Db0w36GAyZIA</a></div><div><br></div><div=
>Specifically they are able to &quot;beat the speed of light&quot; between =
you and a website such that if you communicate with Bob, they can sent comp=
eting packets that will arrive before Bob&#39;s packets. They have =C2=A0re=
altime deep packet insertion able to inject arbitrary data into an TCP stre=
ams and can change file downloads **on the fly**. This can be done remotely=
.</div>

<div><br></div><div>Sourceforge do not have https downloads, so this is yet=
 another reason to move downloads to somewhere that does - like github.</di=
v><div>The NSA has the ability, right now to change every download of bitco=
in-qt, on the fly and the only cure is encryption.</div>

<div><br></div><div>Revealed as part of the presentation is the fact that i=
f the NSA has access to these capabilities, then so do others and in fact o=
ne of the things revealed yesterday was independently discovered already an=
d published.</div>

<div><br></div><div>Same goes for the <a href=3D"http://bitcoin.org">bitcoi=
n.org</a> site - why are we dragging our feet on installing an SSL certific=
ate and redirecting all http to https? While no solution is perfect, it&#39=
;s a lot better than zero defense.=C2=A0</div>

<div><br></div><div>You can see the irony of disseminating the bitcoin cryp=
to-currency client =C2=A0in the clear.</div><div><br></div><div>For anyone =
who has not seen the video. You will be shocked by what is actually in the =
wild being used today. It goes way beyond anything imaginable even in scien=
ce fiction.</div>

<div><br></div><div><a href=3D"https://www.youtube.com/watch?v=3Db0w36GAyZI=
A">https://www.youtube.com/watch?v=3Db0w36GAyZIA</a><br></div><div><br></di=
v><div>Drak<br></div><div><br></div></div>

--e89a8f3bac6fcb8e8d04eed4b1ed--