Tokaiju

Colourful paint pigments preserved in their original pots.

I'm aware that in some ways I'm a weird luddite but this is one of the major, major problems that I have with so much of the modern technology landscape existing as tools that allow you to access your data rather than tools which allow you to store your data.

Look at the data that you have. Look at what you are storing. Ask yourself "if the internet stopped working tomorrow, would I be able to access this information?"

If the answer is "no" you have 2 problems:

1 - You don't actually have that information and can easily lose access to it.

2 - You may not know who DOES have access to that information. If it's encrypted storage you're probably somewhat secure, but IS it encrypted storage? Or is it stored in plaintext on someone else's server?

So my deal with the EARN IT Act is that I don't super duper trust any of our government systems to do fuck all. I think it's worthwhile to contact your representatives, but I don't know that it will actually DO anything.

However YOU can do something.

If you don't want your data accessible to companies that will scan it and test it and pass it on to the government, don't give those companies your data.

Store things locally. Learn how to send and share encrypted files. If you have to store things online, store them with encryption that *you* have set up.

Honestly I'm pretty sure this is going to be bad. I'm pretty sure there are going to be significant security compromises as a result of the EARN IT Act and that we're going to get so buried in breached data that it's going to fundamentally alter how we have to identify ourselves in ways that will be more difficult to use while making people easier to track.

It's shit, and I hate it, and the internet is getting smaller and more fenced in and the big fun platforms that were easy to use and that let people of all technical skill levels share and collaborate that we had a couple decades to explore are now things that will just be a means of exploitation.

It fuckin' blows, friends.

But it also means that NOW is the time to fundamentally re-think how you interact with the internet. Ask yourself how you send data, and where you keep it. Ask yourself who has your information and how it is secured. Ask yourself what would happen if someone who hated you had access to your primary email account for a day, and ask yourself how you would try to fix what they fucked up.

EARN IT sucks, but this is NOT one of those instances in which you are helpless if it passes. Right now, before it passes, talk to the non-internet people in your life about why it is bad:

- It will mean that the government can see all your stored files - It will mean the websites you store files on will not be allowed to encrypt those files - It will mean that any asshole hacker who can access those systems can access all that data that will now be unencrypted.

This shitty act will make EVERYONE who uses the websites that are subject to the EARN IT act more vulnerable to data breaches, ID theft, and exploitation from hackers while ALSO enabling effortless surveillance by our own government.

This is bad, so tell your relatives and friends and co-workers to tell their representatives WHY it is bad by using this site: https://act.eff.org/action/stop-the-earn-it-act-to-save-our-privacy

The site is very easy to use and literally you do not even have to navigate to a separate page to contact your representatives.

It sucks trying to use a site like Tumblr or Twitter through a VPN or on TOR. It's slow and terrible because they are BIG sites moving a lot of data.

It's maybe time to start setting up email lists and forums for the people you want to be in touch with. Make sure that you don't only know your online friends through their social media profiles, but have other ways of contacting the people you care about.

If tumblr went down *today*, right now, who would you be able to find elsewhere on the internet and who would you lose forever? If discord got taken down tomorrow, is there somewhere else online that you'd be able to tell a friend who you are?

If you want to take action here are some things that you can do TODAY that will make you less vulnerable to these sorts of harms:

Create an account on Cryptpad.Fr - Cryptpad is an open-source, zero knowledge collaboration tool that is an excellent browser-based replacement for Gsuite. It doesn't have app support, but it is a really fantastic tool to work on shared documents in a secure way. You don't even have to have an account to access and work on a document. Free accounts come with 1GB of personal storage; this is actually a LOT of storage if you're keeping in good practice of storing your important files locally rather than online. It's also a great free, non-google, non-microsoft office suite that is more portable than Libre Office. If you do have the funds to support them as well as creating an account, please consider it.

Create a ProtonMail account. Protonmail is an end-to-end encrypted email service based in Switzerland that allows you to create free accounts with a limited amount of storage. Please note: while ProtonMail has zero-knowledge storage, they can be compelled to produce the user information that they have access to, including login and IP address data. If you need to make sure that no one knows you're logging in to protonmail you need to log in through an anonymizer like TOR.

Learn how to use TOR - which is very easy; it's pretty much like just using any other browser. Download it, install it, poke around a bit, and do some light-weight browsing. People think it's scary because it's something that hackers use and that governments yell about; it's not. It's also not ideal for day-to-day use, but it's good to already have it running when you need it instead of scrambling to use it in a panic if the EARN IT act passes.

Start using a password manager. If there is nothing else from this list that you do today, this is the one thing you should do. The other stuff can wait until later, but if the internet may soon be less secure as a result of EARN IT, the very least that you can do is secure your logins. Bitwarden is a free, portable, exceptionally functional Open Source password manager that has wonderful resources on its website that teach people at all skill levels how to effectively use the product. Please, Please, Please, PLEASE as the random ass hacker-type person in your life I am *BEGGING* you to use a password manager. And Bitwarden is free, but if you get the paid version for $10 a year you can get encrypted file storage and sending tools as a part of the package. Learning how to create and send encrypted files can be confusing and frightening for people who haven't done it before. It is VERY easy with Bitwarden and they have a lot of accessible info teaching you how to use that tool.

I am concerned about statements like this:

Unless you cite your sources and explain to me in technical terms how you think that Tor is being used by the NSA as a honeypot this is not a reasonable statement to make.

Tor DOES receive a large amount of funding by the US government. Tor DOES work on active projects with the military.

Do you know why?

Because intelligence agencies have a very strong incentive to ensure that there is a widely-available tool used by lots of people to anonymize traffic.

Because a traffic anonymizer that is exclusively used by intelligence agencies is a dead giveaway that the only people using it are fucking feds and spies.

So here's my problem: Tor is the absolute easiest way for people with the lowest level of technical skill to attain some kind of IP anonymization online.

It isn't perfect, and the system isn't invulnerable to attacks, and there are legitimate reasons to be concerned about the ways that traffic can be monitored.

There HAS been evidence of Tor reporting vulnerabilities to the FBI before they report it to general users. There HAVE been problems with people using the network getting fingerprinted and tracked.

But a lot of complaints about Tor's use by the government look like this:

While Syverson indicated that some of the security issues identified by this research have been addressed in recent Tor versions, the findings only added to a growing list of other research and anecdotal evidence showing Tor’s not as safe as its boosters want you to think — especially when pitted against determined intelligence agencies.

Case-in-point: In December 2013, a 20-year-old Harvard panicked overachiever named Edlo Kim learned just how little protection Tor offered for would be terrorists.

To avoid taking a final exam he wasn’t prepared for, Kim hit up on the idea of sending in a fake bomb threat. То cover his tracks, he used Tor, supposedly the best anonymity service the web had to offer. But it did little mask his identity from a determined Uncle Sam. A joint investigation, which involved the FBI, the Secret Service and local police, was able to track the fake bomb threat right back to Kim — in less than 24 hours.

As the FBI complaint explained, “Harvard University was able to determine that, in the several hours leading up to the receipt of the e-mail messages described above, ELDO KIM accessed TOR using Harvard’s wireless network.” All that Tor did was make the cops jump a few extra steps. But it wasn’t hard, nothing that a bit of manpower with full legal authority to access network records couldn’t solve. It helped that Harvard’s network logging all metadata access on the network — sorta like the NSA.

(bolding mine)

Did you catch that? Someone sent a bomb threat via Tor over a wireless network that logged all user metadata and this author is suggesting that's a problem with *Tor.*

Here's more from the same article:

In 2013, they took down Freedom Hosting, which was accused of being a massive child porn hosting operation — but not before taking control of its servers and intercepting all of its communication with customers. The FBI did the same thing that same year with the online drug superstore Silkroad, which also ran its services in the Tor cloud. Although, rookie mistakes helped FBI unmask the identity of Dred Pirate Roberts, it is still a mystery how they were able to totally take over and control, and even copy, a server run in the Tor cloud — something that is supposed to be impossible.

And some more:

Back in 2007, a Swedish hacker/researcher named Dan Egerstad showed that just by running a Tor node, he could siphon and read all the unencrypted traffic that went through his chunk of the Tor network. He was able to access logins and passwords to accounts of NGOs, companies, and the embassies of India and Iran. Egerstad thought at first that embassy staff were just being careless with their info, but quickly realized that he had actually stumbled on a hack/surveillance operation in which Tor was being used to covertly access these accounts.

Uh. This guy's primary method of attacking Tor seems to be pointing out that Tor doesn't encrypt traffic and so people get caught using it when their traffic is unencrypted.

That is a LOT of the criticism that you see about Tor.

Yeah. It's not a VPN. It's a traffic anonymizer.

Look. Buds.

Tor isn't an NSA honeypot that is snooping on your traffic. Tor is a decent anonymizing tool that is run by an open source project and largely funded by the US government because they can't do their gray man hide in plain sight bullshit if they're the only one walking around.

Here's Luckygreen, an oldschool cypherpunk and crypto activist, talking about Tor as it was being conceived of in 1997:

At the FC'97 rump session, Paul Syverson from NRL presented a paper titled "Onion Routing". The description of the system sounds very much like Wei Dai's PipeNet. However, the development team seems to be unaware of PipeNet and the discussions about it that we had in the past. NLR has currently five machines implementing the protocol. Connection setup time is claimed to be 500 ms. They are looking for volunteers to run "Onion Routers". It appears the US military wants to access websites without giving away the fact that they are accessing the sites and is looking to us to provide the cover traffic. What a fortunate situation.

And here's some more from him on the topic:

>What do you think of the "onion routing" approach from the group at Naval Postgraduate? How would compare it to this newest proposal? Neither one of them is any good in its present form. The folks at the FC'97 rump session got to watch Jim and myself poke truck sized holes into the NRL design within seconds of them ending their presentation. :-) Here was a US military research lab presenting a system they thought would give them a way to surf the Net anonymously by using the public for cover traffic. [Let me just spell out here that I believe that the people from NRL and Cypherpunks are on the same side on this issue. Their concern is COMSEC, not SIGINT.]

If you don't know what that last sentence in brackets means, let me explain it:

Comsec is communications security; sigint is signals intelligence. Comsec means keeping your own comms secure; signals intelligence is deriving intelligence from intercepted signals.

The NSA/CIA/FBI/US Navy are all interested in making sure that Tor is alive and well and running but it is largely so that they can send their own messages on a well-supported, widely used tool. This is widely and openly discussed in emails between developers and intelligence agencies and it is being reframed as "the NSA is using this tool to spy on you."

Again, Tor is not perfect. It does not encrypt your traffic and it is possible - with a significant amount of effort, time, and expense - to exploit the Tor network to eliminate anonymization.

But unless you can articulate how to deanonymize Tor traffic *separate from the now-six-and-eight-year-old attacks in 2014 and 2016* I can't take you seriously when you talk about how Tor isn't a useful tool and/or is some kind of honeypot or data gathering scheme.

It is either a fundamental or wilful misunderstanding of how this technology works and what it is meant to do to act as though it's useless to use Tor because Tor is *also* used by the military and CIA.

Tor is one of the better tools out there to anonymize your IP address. It is vital to OSINT researchers, hackers, activists, and whistleblowers. Telling people NOT to use this tool while not providing a better solution with instructions on how to use it is the kind of misinformation that ruins people's lives.

Francisco Monción and Nicholas Magallanes in George Balanchine’s Orpheus

a. this musical number comes completely out of nowhere, with no greater context than what this video captures; and

A short thread about radical leftist Japanese hard hat culture, translated and stolen from German twitter, sorry for the Germanness (Germanity?) of some of the text:

What in the West is the balaclava, in Japan is the hard hat. It is THE symbol of the radical, militant left, especially in the 60s. The Japanese word for it is "Geba-heru," a loanword from German(!) and means Gewalt Helm: "violence helmet."

Trademark of the "Geba-heru": Each group has (had) its own helmet, with the group's inscription and color. They are used uniformly by the group during actions, as can be seen in the pictures.

This was the cheapest helmet you can still buy in any hardware store today and was given out for free, for example, in student dorms (which used to be self-managed left-wing centers) because of earthquakes. It was used as protection against police batons, without any grand worker’s romanticism behind it.

Today, the "Geba-heru" is hardly seen at protests anymore. Although not illegal, it largely represents ossified Communist sects that have survived since the 1960s.

They are most likely to be seen as a museum piece, as here in a museum in the city of Narita. Until the 80s, there were militant protests against the airport construction there.

The Japanese RAF (of which there were a total of 3 splinter groups) also started as a militant campus group and openly appeared with helmets in public before going underground. The German RAF, by the way, took its name from the Japanese one. Kein joke.

(note: https://en.wikipedia.org/wiki/Red_Army_Faction_(Japan))

The "Geba-Heru" has deeply embedded itself in Japan's collective memory. A few years ago, Japan's most famous girl pop band, named "AKB 48," even made a music video in the typical "leftist student" look. It's... bizarre??

But why a German loanword? Well, left-radical scene slang in Japan includes several such loanwords. Parutai (Party), Bunto (Union), Kerun (Core), and more. This comes from the fact that in the 60s, not English, but German was the number one foreign language of the Japanese left. Why?

Well, Uncle Karl (Marx) sends his regards. German left-wing philosophers have had and continue to have a significant influence on left-wing theoretical discourses in Japan. Even today, you meet quite a few leftists who can at least read German to some extent.

That’s not the right IRS rule.

$599.99 is the amount below which a business does not need to issue a 1099 to a contractor who provides business services. The contractor still needs to report the income on their taxes.

The correct number for the IRS rule for money that is gifted rather than received in a business transaction is $13999.99–more than that, and the recipient has to pay tax on the gift and report it to the IRS. Less than that, and there’s no taxation or reporting requirement.

If we’re choosing amounts on the basis of IRS limits, give these people $13,999.99. 

Audio: A recording of Leonard Nimoy reading it on Internet Archive.

Text: A PDF version.

Nemoy’s voice is PERFECT in this!

the last time I reblogged this post right before I got a great job, in a permanent work-from-home position, with benefits, retirement, and a salary literally 3x what I was making before, doing something I really like. 

So you know.