Hejsan,
Nästa styrelsemöte för DFRI kommer att vara på måndag 18/8, klockan 18.30.
Styrelsemötena är öppna för medlemmar och du anmäler ditt intresse för att gå genom att maila dfri(a)dfri.se
Agendan kommer snart, men om du har frågor du vill ta upp kan du maila dem till oss redan nu på samma adress.
Lokal är inte bestämd än, men det blir någonstans centralt i Stockholm. Alla som föranmäler sig får mer information innan mötet :)
Hälsningar
Hanna Larsson, Ordförande
--
DFRI-listan är öppen för alla.
Listan arkiveras och publiceras öppet på internet.
Arkiv: http://dir.gmane.org/gmane.org.user-groups.dfri
Listpolicy: https://www.dfri.se/regler-for-listan
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
109 packade sidor med extra allt.
"This study analyses the Data Retention Directive Judgement of the Court
of Justice of the European Union of 8 April 2014 and evaluates its
impact on other data retention measures at Member States as well as at
EU level."
http://www.greens-efa.eu/data-retention-12640.html
//Erik
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/
iQEcBAEBAgAGBQJT0WYQAAoJEEQJK+0DIPSkeK8IAK8x8tGIsfnZNKfThzUm2YUG
rZzD+N2L+ke8P9X2ew3AzOKupF1j2w08xiEYrPK6HMyH1v7Zfmti74d+S3tX3N53
joQwro2/3bJEjyYfcEkqypR3zPxLjA+kD6MpNsqUlzQbA6U7STkKgm0Jmru5/ziG
qVY128V7YqX9/MOCNXFgpRjkMWWfRMJPcL8mtYs+ZrZNr6ultVSHOiIWrk4AwCYA
cXxUn/Us//dECg7t935z/k1zV0O0dKYog9tWjIyFjG4itb+4vKLgw4oNPdf3bNwO
V36l4EyqHIV149jhaAYGoiTRsvE7z7A36xvKn6lJpO1vjc1dRE8vlvTVDeXPZrI=
=KoHq
-----END PGP SIGNATURE-----
--
DFRI-listan är öppen för alla.
Listan arkiveras och publiceras öppet på internet.
Arkiv: http://dir.gmane.org/gmane.org.user-groups.dfri
Listpolicy: https://www.dfri.se/regler-for-listan
Den här skriften borde intressera folk här på listan, en brittisk handbok i informationssäkerhet riktad mot journalister:
http://www.tcij.org/resources/handbooks/infosec
Begin forwarded message:
> From: Arjen Kamphuis <arjen(a)gendo.ch>
> Subject: [cp-global] Infosec 4 journalists (and other humans)
> Date: 14 Jul 2014 10:16:46 GMT+2
> To: general(a)hackerspaces.nl, privacycafe(a)privacycafe.nl, "noisysquare(a)noisysquare.com" <noisysquare(a)noisysquare.com>, global(a)cryptoparty.is
>
> Dear fellow hacktivists,
>
> For the UK Centre for Investigate Journalism I have co-authored a
> handbook 'Information Security for Journalists'. This is a book in a
> series of handbooks commissioned by the CIJ with the aim to produce
> densly packed knowledge for investigative journalists who operate at the
> sharp end of the profession (either operating in scary countries or
> against scary opponents). It is however also very usable for other
> humans who just want to back up their UNDHR article 12 rights with some
> strong crypto.
>
> Most of the credit for the writing goes to my co-author Silkie Carlo who
> works with intelligence whistleblowers for a living. All technical
> mistakes are mine.
>
> Last week we published an initial version of the handbook during the
> CIJ's yearly Summerschool Conference:
> http://www.tcij.org/resources/handbooks/infosec
> This book is intented as a practical crashcourse that any interested,
> non-IT-specialist individual can run through in a long weekend (or two).
> We are currently processing feedback from journalists who have been
> trying it out and putting resources in place to do maintenance and
> translations into a dozen+ languages (including Arabic, Russian and
> Chinese).
>
> Interview with RT's Max Keiser:
> http://www.gendo.nl/en/blog/arjen/bankrupting-the-nsa-with-tails-defeating-…
>
> Feedback most welcome! (feedback mail in book and on the above page).
>
> The entire book is Creative Commons licenced (BY-NC-SA) and so will all
> future versions be, including the translations. We're working on ebook
> formats and will make dead-tree versions after the summer when we've
> worked in two months of feedback.
>
> To the best of my knowledge there was nothing like this available up to
> now. If I'm wrong please point me to other materials I may have missed.
> Thanks!
>
>
> --
> Met vriendelijke groet/With kind regards/Mit Freundlige Grußen,
> Arjen Kamphuis
> Gendo B.V.
>
> Main: +31 20 891 0330
> mail: arjen(a)gendo.ch
>
> gendo.ch (website)
> gendo.nl/blog/arjen (Dutch blog)
> gendo.ch/en/blog/arjen (English blog)
>
> about.me/arjenkamphuis (social media)
>
> files.gendo.nl/keys/arjen(a)gendo.ch.asc (public key)
> PGP fingerprint:
> 55FB B3B7 949D ABF5 F31B BA1D 237D 4C50 118A 0EC2
>
> ============================================================
> This e-mail message and its attachments are subject to the disclaimer
> published at the following website of Gendo:
> http://www.gendo.nl/disclaimer Gendo B.V. is registered with the trade
> register in The Netherlands under number 28116864.
>
> _______________________________________________
> global mailing list
> global(a)cryptoparty.is
> https://cryptoparty.is/cgi-bin/mailman/listinfo/global
Okej, känner till monkeysphere litegrann, men det är WoT om jag fattat rätt.
Samtidigt verkar Convergence vara cert-baserat, eller?
Finns det ingen kombo?
Och fråga två, kan man upphandla sånt här? Man kan ju upphandla IT som ska vara Fri Programvara genom att speca källkod som feature.
//Erik
Peter Norin <peter(a)xpd.se> wrote:
>Ta och kika på DANE[1] eller Convergence[2].
>
>
>/P
>
>
>1. http://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
>
>2. http://convergence.io/
>
>
>On 6Jul, 2014, at 17:11 , JOSEFSSON Erik <erik.josefsson(a)europarl.europa.eu> wrote:
>
>
>Förlåt om det här är ett kraftfullt slag i luften, ,men är det inte dags att bygga infrastruktur som underlättar att fler utfärdar sina egna cert?
>
>Med PGP så gör man ju sitt eget nyckelpar, behövs ingen digital notarie för att jag ska lita på Andreas eller Joel.
>
>Om man tar ett kapitalistiskt perspektiv så borde ju t.ex. DN.SE vara intresserade av att deras annonsörer exponeras till dom som DN har lovat. YouTube som exempel gör det kanske svårare att förstå att det handlar om att veta vem man "tittar på"? Eller?
>
>Om du och Joel skulle säga till mig (genom nån slags WoT) att jag kan lita på att DN.SE verkligen är DN.SE så slipper ju .SE göra det, eller hur?
>
>Det känns helt rimligt samhällsekonomiskt att distribuerad tillit är bra för alla.
>
>Så varför inte investera i det då?
>
>//Erik
>
>________________________________________
>From: Andreas Jonsson [andreas(a)romab.com]
>Sent: Thursday 3 July 2014 22:45
>To: listan(a)lists.dfri.se
>Subject: Re: [DFRI-listan] Öppet brev till Netclean
>
>Hej,
>Om man använder sina egna CA:s och blir påkomna kommer dessa åka ur
>trust-bundlen snabbare än vi hinner blinka, detta för att den typen av
>aktiviteter raserar hela trustmodellen. Mest talande är
>Diginotar-fallet, som tog med sig holländska e-legitimationer i fallet.
>
>De kanske kommer undan en gång med att göra det, men inte fler. Detta
>har dock redan hänt i fallet med turk trust, när de "råkade" utfärda
>gmail.com.
>
>Kolla annars:
>https://www.securelist.com/en/blog/208194063/TURKTRUST_CA_Problems
>
>/andreas
>
>On 2014-07-03 21:57, Per Andersson wrote:
>
>
>2014-07-03 10:40 GMT+02:00 Joel Purra <mig(a)joelpurra.se>:
>
>
>2014-07-02 23:04 GMT+02:00 Martin Millnert <martin(a)millnert.se>:
>
>Det är alltså fullt möjligt i Netcleans ögon, så länge browsers har dessa
>CA:s som Turkiet kontrollerar. Hur ofta tas en CA bort från browsers?
>
>
>Det sker väl lite då och då. T ex togs CAcert bort ur FreeBSD för ett tag sedan
>och ur Ubuntu och Debian nyligen. [0]
>
>I Debian gick det en diskussion om att när CAcert togs bort (för att de inte
>verifierar identit tillräckligt tror jag) att även andra stora CAs
>borde tas bort
>för de signerar vad som helst som skickar pengar. De här stora CA tas inte
>bort för då blir besök på www med Debian totaldrygt för användarna som
>möts av NOT TRUSTED hela tiden. Stora CA är alltså för too big to fail och
>fortsätter att skeppas trots att de inte sköter sig enligt CA-policies osv.
>
>
>Finns alternativ? Kan man tänka sig att implementera någon form av
>certificate pinning[1] på bredare front?
>
>
>Monkeysphere [1] är ett alternativ som använder OpenPGP web of trust för
>att verifiera identitet.
>
>
>[0] https://en.wikipedia.org/wiki/CAcert#Inclusion_status
>[1] http://web.monkeysphere.info/
>
>
>--
>Per
>
>
>--
>DFRI-listan är öppen för alla.
>Listan arkiveras och publiceras öppet på internet.
>Arkiv: http://dir.gmane.org/gmane.org.user-groups.dfri
>Listpolicy: https://www.dfri.se/regler-for-listan
>
>
>--
>DFRI-listan är öppen för alla.
>Listan arkiveras och publiceras öppet på internet.
>Arkiv: http://dir.gmane.org/gmane.org.user-groups.dfri
>Listpolicy: https://www.dfri.se/regler-for-listan
>
>
Långt viktigt mail från Ante. //Erik
-------- Original Message --------
Subject: Answering guides for EU ISDS consultation
Date: Tue, 24 Jun 2014 16:19:06 +0200
From: Ante Wessels <ante(a)FFII.ORG>
Answering guides for EU ISDS consultation
https://www.vrijschrift.org/serendipity/index.php?/archives/158-Answering-g…
or http://bit.ly/1nBEdqX
The European Digital Rights initiative (EDRi) has published an
answering guide for the European Commission's consultation on
investor-to-state dispute settlement (ISDS), probably the most
controversial element of proposed EU trade agreements. The
consultation ends the 6th of July.
ISDS gives foreign investors, usually multinationals, the right
to circumvent domestic courts and challenge decisions of states
for international investment tribunals if decisions may lead to
lower profits than expected. The cases are decided by for-profit
arbitrators, they would be able to overturn decisions of supreme
and human rights courts. For an introduction see Nobel laureate
Joseph Stiglitz or Vrijschrift.
EDRi's answering guide points out procedural and substantive
issues with ISDS. The guide has a focus on human rights and the
negative effects ISDS has on our ability to reform copyright and
patent law. If you do not have a lot of time you may like to
focus on questions 5, 7, 8 and 13.
AK Europa (the Brussels office of the Austrian Federal Chamber
of Labour), ÖGB Europabüro (the Brussels office of the Austrian
Trade Union Federation), and Friends of the Earth Europe have
set up an online tool, which features a template response, and
allows for individual contributions to the consultation in a few
clicks.
Corporate Europe Observatory published "Still not loving ISDS:
10 reasons to oppose investors' super-rights in EU trade deals".
Seattle to Brussels Network: Campaigners slam Commission’s mock
consultation on investor rights in EU-US trade deal
Trade Justice Movement: TJM says no to ISDS
11.11.11: Traité transatlantique : répondons tous à la
commission !
The FFII put on line its draft submission to the consultation
"ISDS: A rigged system, avoid lock-in". The draft conclusion
reads:
This note concludes that investor-to-state dispute settlement
lacks conventional institutional safeguards for independence and
has characteristics of a rigged system. The appointment of
arbitrators is not neutral and gives the US an unfair advantage.
The US never lost an ISDS case, we can not expect European
companies to win major ISDS cases against the US, all the more
as the US is not shy to exert pressure on arbitrators. We can
expect that US companies will win ISDS cases against the EU and
member states. This leads to four considerations.
First, ISDS arbitrators will be able to review all decisions of
governments, legislators and courts, including the European
Court of Human Rights, and they can award unlimited damages. The
European Commission aims to add ISDS to trade agreements from
which it is near impossible to withdraw. Given that ISDS lacks
conventional institutional safeguards for independence, does not
observe the separation of powers, has characteristics of a
rigged system and gives the US an unfair advantage, the transfer
vast powers to arbitrators without possibility of withdrawal
would be imprudent. At the very least, to protect its future,
the EU has to avoid a lock-in, should not deviate from standing
European practice of stand-alone investment agreements. The EU
should not add ISDS to trade agreements.
Second, the EU aims to create a global standard. Presently a
minority of foreign investments is covered by ISDS, after ISDS
agreements between the major capital exporting countries a large
majority of global foreign investments would be covered by ISDS.
Wide coverage of global foreign investments and impossibility to
withdraw would create a near global lock-in. Given that the
commission's reforms fail on many counts, a near global lock-in
would give arbitrators unprecedented and unchecked powers. This
would burden democracies, local companies, tax payers, human
rights and the rule of law.
Third, quintessentially, states need a margin of appreciation.
States which are constantly battered by threats and legal
challenges can not function properly, can not take decisive
action. The US protect themselves through a system rigged to
their advantage. It is an existential threat to the EU not to be
able to take decisive action, especially since the US can.
Raison d'état necessitates to avoid this situation.
Fourth, foundationally, an essential aspect of liberalism is
constitutional liberalism - the separation of powers, the
creation of strong institutions. Sovereign decisional power
accompanied by strong institutions can provide fairness. ISDS
undermines the institutions. ISDS undermines the EU's vital
interests and values, it has to be rejected. In doing so, the EU
would give direction to the debate and create room to strengthen
alternatives.