9 ms·

Internal irc-log of the tor-project reveals debate about hiring an ex-CIA agent

82 points by mercuryIntox 10y ago

pizza 10y ago
Mirror, since these things have a habit of getting deleted... http://hastebin.com/ecuwegiven.xml http://hastebin.com/ecuwegiven.xml
mercuryIntox 10y ago
All this drama spawns a few interesting questions: * How should Open Source Projects deal with internal drama? * Should people who have a history of working with governments be shunned by the infosec community? While I have no input on the first one, I can't help but notice that the connection between tor and the US government is already so strong (funding, the lead developer "arma" being a former NSA intern) that "undermining tor" would be pointless.
- tptacek 10y ago
  If "the infosec community" is a small subculture that has chosen to co-opt the term "infosec" to describe its own idiosyncratic politics, sure. The remaining plurality of software and network security people who have worked at some point with governments can, I suppose, pick a new name for themselves. I never did like "infosec community" as a descriptor.
- coroutines 10y ago
  What gets me is once we know who the ex-government people are, they sure as hell become huge targets for people still working for the gov. I wonder how many times arma has been approached. I hate saying it, but I do feel like ex-gov is fruit of the poisonous tree.. at the same time I think these people specifically would understand the need for tor.
  - ashitlerferad 10y ago
    Depends on their motives for joining the gov in the first place? Leaking and whistleblowing? Awesome! Everything else? Not so much.
nickpsecurity 10y ago
The ridiculous thing about this, if accurate, is that Tor was (is?) primarily funded by an organization connected to State and CIA propaganda efforts. Most of them receive money from US governmemt in sone way. CIA itself uses Tor for same reason Navy created it. While FBI and NSA hate it, the CIA and State love it as a tool for protecting foreign operators or dissenters. Makes it funny they're so worried about bringing CIA in. Anyway, the right way go do security against nation-states is creating deliverables and processes that are verified by mutually-suspicious parties. As in, with high-assurance security, you assume the people are largely malicious while focusing on vetting thd product and process throughout lifecycle. Not sure what this CIA person's role is supposed to be but it's bad INFOSEC and OPSEC if he can unilaterally do lots of damage. Shouldn't be possible. Far as image, just like my subversion-resistant build scheme, having helpful CIA rep onboard as a check American government can trust is beneficial at least for review and testing. Have one from each major government or institution using the service acting as checks against inserted or ignored subversions. Plus non-government groups of course. That one CIA guy can compromise either service or image again makes process or trust assessment look weak. I say let them come onboard but with non-critical access and any actions reviewed. Even if failure, it would teach important lessons.
- woodman 10y ago
  > Makes it funny they're so worried about bringing CIA in. Except for the fact that the USG actually buys into the concept of NOBUS, as evidenced not only in the classification system - but also foreign policy (the proliferation of AA and AT weapons comes to mind). So the USG's use of TOR provides me with zero confidence that they wouldn't actively weaken it. That said, I agree on the issue of trust - secure software shouldn't need any. They need to decide between two very distinct paths: accept the insecurity and try to control it socially (no CIA guys), or mathematically demonstrate infallibility. Because one is so hard, and the inevitable failure of the other can be ignored for now - I'm guessing that we'll see no push for formal verification :)
  - nickpsecurity 10y ago
    Was looking forward to see what you'd say here. :) "Except for the fact that the USG actually buys into the concept of NOBUS" This is true. I considered it given a subverted, but otherwise working, Tor network would be a win-win if CIA was subjected to pressure or wanted to de-anonymize opponents. Yet, the Tor project themselves answer this one: it's vulnerable to a global, passive adversary. NSA has painstakingly built partnerships with all kinds of countries that collectively do a giant SIGINT operation. Most of them probably don't like Tor. CIA or partners can get info from NSA on these things. So, CIA can already defeat Tor for some fraction of users since their partner is outside its probability of success. On top of whatever CIA might pull. "accept the insecurity and try to control it socially (no CIA guys), or mathematically demonstrate infallibility. " Well, remember that there's always the path of just clearly specifying the functionality plus implementing it in the safest way possible. We used to call this medium assurance. OpenBSD is the code-only version of that. Praxis w/ Ada/SPARK is the spec + code version. Only around 30-50% premium in labor/cost added doing these things despite immunity to all kinds of shit. They aren't going to do it, though. They never do. Leading to... "I'm guessing that we'll see no push for formal verification :)" ...no push for that or even system-oriented languages and techniques that make the service immune to memory- or interface-level attacks that make up 80-90% of vulnerabilities. Not even that.
jlg23 10y ago
I honestly don't get why this is coming up now. TOR's funding never was a secret. Serious infosec people didn't need Snowden to be suspicious about the actual anonymity provided. If one was not concerned back then, what does an ex-CIA agent (or even not-so-ex CIA agent) in the tor project change?
- nickpsecurity 10y ago
  "TOR's funding never was a secret." Sort of. The Pando article they reference, which showed me more about them than the author, points out that they try to promote the funding as "independent" source rather than U.S. government-backed groups made by or tight with CIA. All the press around the situation would make you think it's a group for the people, by the people, and so on with some historical military connection. Whereas, the people aren't funding most of Tor: "The Man" Tor appears to oppose is. Even in this conversation, they're worried about that image situation and how to minimize exposure that one CIA person might work in Tor despite the fact that such types are funding it it. If it's so transparent, you wouldn't have so much work on that. Who knows why it's coming up & it's not secret as you said. Yet, Tor pages I've read certainly weren't describing themselves as a tool of U.S. intelligence agencies funded by their fronts. They seem to work at avoiding that in favor of some image independent that U.S. intelligence just happens to also like and use. Which is inaccurate. I'm curious. If we take away all U.S. govt connected funding, then how much is left for the developers and how many will that be? That should be a hint at level of independence.
  - tptacek 10y ago
    "Sort of"? Tor was a project of the Naval Research Labs. Even 51% of Wikipedia editors know about its USG funding.
    - nickpsecurity 10y ago
      Your point doesn't contradict mine even if made-up 51% number was true. Selective as usual focusing on its start and fact there's USG funding. Yet, a person looking on site at "About Tor," "Core team," and "Sponsors" doesn't get a clear indicator that the vast majority of funds so far as come from groups CIA created to wage propaganda wars and act for U.S. foreign policy. That fronts allegedly separated from despite them doing basically the same jobs today funded by U.S. government doesn't reduce that concern. Readers might think instead it's a mostly for-the-people organization whose funding is spread out among many groups instead of the kind its libertarian proponents would seem to fight rather than work for. Then, we have chat logs from a group funded by CIA & affiliates worried about their image if one CIA person is in the project. Hence, "sort of." I'll change my statement to their source of support being clear when they state such things clearly on their web site and stop the kind of smears I saw in response to the Pando article. I mean, here's people taking money from CIA and/or affiliates openly speculating that someone saying so or implying it means something must be... working for CIA, a fascist, or something in a smear job. Repeat, people paid by vicious, authoritarian regimes they claim to fight accusing someone of evil or connections to such regimes for reporting their source of funding. Unreal... I'll be interested to see how long popular support for Tor lasts if it's marketed as a former Navy tool currently supported by CIA and State department groups. The reality probably will change the perception of it and when/where to use it a lot. I still support the project as realists like me know it's a double-edge sword they need to work but might try to compromise in limited ways. Hence, me pushing strong security engineering to be applied to it.
frunt 10y ago
What a histrionic, over-emotional mess these people are. With personalities like that, it's a wonder any meaningful work on Tor gets done.
- ethbro 10y ago
  Agreed on one hand. But on the other hand, these are literally (as noted in the log) people who have physical security concerns travelling to a large part of the world if their identities are public. Only paranoia if your laptop doesn't get seized at customs every time you fly, etc etc.
- ocdtrekkie 10y ago
  People are likely to act much differently when facing an "existential threat". Certainly for the guy worried this could get his family killed, but even just for people who've invested years of work into the Tor project, and think this could lead to it's downfall. For something like Tor, userbase has a particularly key role in maintaining the project. This is likely something to do with the instinctual "fight or flight" response. I think you can see people who chose each in this chat log.
Aelinsaar 10y ago
I like to think that most people don't expect something like TOR to protect against a determined government. That doesn't make TOR useless, since I suspect that most people are not trying to be anonymous from intelligence agencies, only law enforcement agencies.
- tptacek 10y ago
  Hasn't Tor already demonstrably failed to protect people from US law enforcement? Tor is an important research project. But that's what it is.
  - jimktrains2 10y ago
    Are you talking about the current FBI case? That was an exploit in the Tor Browser Bundle (could force the browser to make a request using the non-tor network), not in the Tor Network itself.
    - tptacek 10y ago
      No, I was referring to the FBI hidden service de-anonymization attack from last year.
      - deleted 10y ago
        [deleted]
      - belorn 10y ago
        You mean the Flash based NIT exploit, as part of Metasploit? Flash which is by default off in TBB and has really nothing to do with tor, is actively discouraged by the tor project, and is in strong decline world over? Or are the talking about the Carnegie Mellon attack that modifying Tor protocol headers? If so, is that fixed security bug enough to judge tor as failure and only usable for research? Even seatbelt, which has a fairly simple concept, had initial issues and are still being improved. On the topic of the Carnegie Mellon attack, the tor project both addressed the protocol header bug and changed their security practices. Strange activity in the tor network has in the past been deemed safe until proven harmful, but as a result of having an research university doing attacks on users of the network, that practice has been reversed and strange activity is now deemed harmful until proven safe.
deleted 10y ago
[deleted]
gnu8 10y ago
Why are we letting USG people be involved with anything? Anyone with a current or former association with the military-industrial complex should be blacklisted. These people are nothing but trouble; they are ideologically untrustworthy and very likely beholden by both carrots and sticks to government interests. They're unfit to be involved in any project but especially those with security implications to the average person.
- atdt 10y ago
  For one: because much of what we know of the surveillance capabilities of state actors and the ways these capabilities are being used, we owe to whistleblowers like Edward Snowden, Chelsea Manning, and Thomas Drake.
  - bsjsjjdjdjj 10y ago
    ^ this.
  - eternalban 10y ago
    "what we know of the surveillance capabilities Correction: What you have been told.
- ashitlerferad 10y ago
  How do you know USG people aren't infiltrators from Tor/etc?
shruubi 10y ago
Don't want to drag up the whole Jacob Applebaum thing again, but just the way he talks in these logs makes me wonder how anyone could tolerate working with someone who keeps saying things like "I did X, I did Y". It's surprising that it seems like only Isis really stood up to his line of questioning while the rest kind of fell silent.
- fapjacks 10y ago
  He is insufferable! Exactly the kind of person that makes at least half of Freenode so awful to participate in.
  - cocotino 10y ago
    +1, this is just typical irc behaviour.
- anonbanker 10y ago
  you're surprised that most of the channel agreed with him?
- e12e 10y ago
  For other's not up to speed, I take it Jacob Applebaum's nick is the same as his twitter handle, ioerror.
libeclipse 10y ago
At one point they say that the CIA would do and say anything to keep an agent's cover. If so, then why would they send an agent in who's openly admitting to being an agent?
- anonbanker 10y ago
  he lied and said he was from the state department first.
rasz_pl 10y ago
There is no such thing as 'ex-CIA agent'
- SEJeff 10y ago
  Correct, the title is "Officer" of the "National Clandestine Service", a part of the CIA. Source, I worked with some spooks in Iraq when I was US Army Military Intel (UAV was then changed to Aviation after I got out).
anonbanker 10y ago
After reading this, I'm pretty sure I understand why Appelbaum is getting bombarded Assange-style with rape/harassment allegations: He single-handedly acted as the voice of reason in this conversation.
- mercuryIntox 10y ago
  > ioerror: I shut down the city of san francisco to stop the war > ioerror: Once, I was deported from Lebanon for being jewish, which was because htey said i was a spy for israel (false) > ioerror: If we have a CIA person working with Tor, I won't get out of that next time, I fear I sincirely hope you are being ironic.
  - anonbanker 10y ago
    I fail to see how your quotes discount anything I say. Do you have evidence that he wasn't deported for being jewish, and that having CIA ties to Tor wouldn't cause him injury? Do you have evidence that he didn't hack SF infrastructure as hacktivism?
raverbashing 10y ago
Why are they using IRC instead of something like SILC? Or is this an internal IRC channel that's only accessible using TOR (or maybe something else?)
ivraatiems 10y ago
Is there a breakdown somewhere of who these individuals are/what their relationship to the project is? I find that more context I'm missing might help me understand.
kriro 10y ago
I can't quite connect the dots...how is the involvement of the ex-CIA guy putting the family of one of the people in the logs in (more) danger? It's already CIA funded so any government that wants to torture people for using Tor can already legitimize that practice (but tbh why would they even bother) since they are "using CIA-software" or whatever reason you want to give. I feel like I'm missing a logical step here. I do think ex-spies should not be involved in the project and the insistence of DaveC1 is really odd (as is joining before getting clearance to say he was CIA...why not get that first then ask if he can join). Why isn't he coming to the conclusion that it is probably a bad idea and he can get involved in other ways. Do we know who leaked this, is it more likely to be someone on the pro or contra ex-CIA-involvement side? Logically it makes no sense for say mrphs to leak this, right?
tor-internal 10y ago
Here is a list of people in the chat by username. Info on what each of them does at Tor is at https://www.torproject.org/about/corepeople.html.en https://www.torproject.org/about/corepeople.html.en asn: George Kadianakis atagar: Damian Johnson athena: Andrea Shepard DaveC1: David Chasteen gamambel: Moritz Bartl helix: Erinn Clark ioerror: Jacob Appelbaum infinity0: Ximin Luo isis: Isis Agora Lovecruft Julius23: Julius Mittenzwei Lunar^: Lunar mikeperry: Mike Perry mrphs: Nima Fatemi puffin: Karen Reilly Phoul: Colin Childs qbi: Jens Kubieziel Runa: Runa Sandvik sekritarma: Roger Dingledine sysrqb: Matt Finkel weasel: Peter Palfrader yawning: Yawning
crumpled 10y ago
RE: Those reactions from mrphs and ioerror Apparently TOR's reputation can be utterly destroyed and result in loss of life by something as simple as a person trying to join the team. Who knew? They claim that just by approaching them he did damage, why didn't they think of this before? Just send agents to offer to write blog posts, watch the devs flip out and revoke their keys. Seriously, if that's all it takes, you have bigger problems.

82 points by mercuryIntox 10y ago

pizza 10y ago

Mirror, since these things have a habit of getting deleted... http://hastebin.com/ecuwegiven.xml http://hastebin.com/ecuwegiven.xml

mercuryIntox 10y ago

All this drama spawns a few interesting questions: * How should Open Source Projects deal with internal drama? * Should people who have a history of working with governments be shunned by the infosec community? While I have no input on the first one, I can't help but notice that the connection between tor and the US government is already so strong (funding, the lead developer "arma" being a former NSA intern) that "undermining tor" would be pointless.

tptacek 10y ago
If "the infosec community" is a small subculture that has chosen to co-opt the term "infosec" to describe its own idiosyncratic politics, sure. The remaining plurality of software and network security people who have worked at some point with governments can, I suppose, pick a new name for themselves. I never did like "infosec community" as a descriptor.
coroutines 10y ago
What gets me is once we know who the ex-government people are, they sure as hell become huge targets for people still working for the gov. I wonder how many times arma has been approached. I hate saying it, but I do feel like ex-gov is fruit of the poisonous tree.. at the same time I think these people specifically would understand the need for tor.
- ashitlerferad 10y ago
  Depends on their motives for joining the gov in the first place? Leaking and whistleblowing? Awesome! Everything else? Not so much.

nickpsecurity 10y ago

The ridiculous thing about this, if accurate, is that Tor was (is?) primarily funded by an organization connected to State and CIA propaganda efforts. Most of them receive money from US governmemt in sone way. CIA itself uses Tor for same reason Navy created it. While FBI and NSA hate it, the CIA and State love it as a tool for protecting foreign operators or dissenters. Makes it funny they're so worried about bringing CIA in. Anyway, the right way go do security against nation-states is creating deliverables and processes that are verified by mutually-suspicious parties. As in, with high-assurance security, you assume the people are largely malicious while focusing on vetting thd product and process throughout lifecycle. Not sure what this CIA person's role is supposed to be but it's bad INFOSEC and OPSEC if he can unilaterally do lots of damage. Shouldn't be possible. Far as image, just like my subversion-resistant build scheme, having helpful CIA rep onboard as a check American government can trust is beneficial at least for review and testing. Have one from each major government or institution using the service acting as checks against inserted or ignored subversions. Plus non-government groups of course. That one CIA guy can compromise either service or image again makes process or trust assessment look weak. I say let them come onboard but with non-critical access and any actions reviewed. Even if failure, it would teach important lessons.

woodman 10y ago
> Makes it funny they're so worried about bringing CIA in. Except for the fact that the USG actually buys into the concept of NOBUS, as evidenced not only in the classification system - but also foreign policy (the proliferation of AA and AT weapons comes to mind). So the USG's use of TOR provides me with zero confidence that they wouldn't actively weaken it. That said, I agree on the issue of trust - secure software shouldn't need any. They need to decide between two very distinct paths: accept the insecurity and try to control it socially (no CIA guys), or mathematically demonstrate infallibility. Because one is so hard, and the inevitable failure of the other can be ignored for now - I'm guessing that we'll see no push for formal verification :)
- nickpsecurity 10y ago
  Was looking forward to see what you'd say here. :) "Except for the fact that the USG actually buys into the concept of NOBUS" This is true. I considered it given a subverted, but otherwise working, Tor network would be a win-win if CIA was subjected to pressure or wanted to de-anonymize opponents. Yet, the Tor project themselves answer this one: it's vulnerable to a global, passive adversary. NSA has painstakingly built partnerships with all kinds of countries that collectively do a giant SIGINT operation. Most of them probably don't like Tor. CIA or partners can get info from NSA on these things. So, CIA can already defeat Tor for some fraction of users since their partner is outside its probability of success. On top of whatever CIA might pull. "accept the insecurity and try to control it socially (no CIA guys), or mathematically demonstrate infallibility. " Well, remember that there's always the path of just clearly specifying the functionality plus implementing it in the safest way possible. We used to call this medium assurance. OpenBSD is the code-only version of that. Praxis w/ Ada/SPARK is the spec + code version. Only around 30-50% premium in labor/cost added doing these things despite immunity to all kinds of shit. They aren't going to do it, though. They never do. Leading to... "I'm guessing that we'll see no push for formal verification :)" ...no push for that or even system-oriented languages and techniques that make the service immune to memory- or interface-level attacks that make up 80-90% of vulnerabilities. Not even that.

jlg23 10y ago

I honestly don't get why this is coming up now. TOR's funding never was a secret. Serious infosec people didn't need Snowden to be suspicious about the actual anonymity provided. If one was not concerned back then, what does an ex-CIA agent (or even not-so-ex CIA agent) in the tor project change?

nickpsecurity 10y ago
"TOR's funding never was a secret." Sort of. The Pando article they reference, which showed me more about them than the author, points out that they try to promote the funding as "independent" source rather than U.S. government-backed groups made by or tight with CIA. All the press around the situation would make you think it's a group for the people, by the people, and so on with some historical military connection. Whereas, the people aren't funding most of Tor: "The Man" Tor appears to oppose is. Even in this conversation, they're worried about that image situation and how to minimize exposure that one CIA person might work in Tor despite the fact that such types are funding it it. If it's so transparent, you wouldn't have so much work on that. Who knows why it's coming up & it's not secret as you said. Yet, Tor pages I've read certainly weren't describing themselves as a tool of U.S. intelligence agencies funded by their fronts. They seem to work at avoiding that in favor of some image independent that U.S. intelligence just happens to also like and use. Which is inaccurate. I'm curious. If we take away all U.S. govt connected funding, then how much is left for the developers and how many will that be? That should be a hint at level of independence.
- tptacek 10y ago
  "Sort of"? Tor was a project of the Naval Research Labs. Even 51% of Wikipedia editors know about its USG funding.
  - nickpsecurity 10y ago
    Your point doesn't contradict mine even if made-up 51% number was true. Selective as usual focusing on its start and fact there's USG funding. Yet, a person looking on site at "About Tor," "Core team," and "Sponsors" doesn't get a clear indicator that the vast majority of funds so far as come from groups CIA created to wage propaganda wars and act for U.S. foreign policy. That fronts allegedly separated from despite them doing basically the same jobs today funded by U.S. government doesn't reduce that concern. Readers might think instead it's a mostly for-the-people organization whose funding is spread out among many groups instead of the kind its libertarian proponents would seem to fight rather than work for. Then, we have chat logs from a group funded by CIA & affiliates worried about their image if one CIA person is in the project. Hence, "sort of." I'll change my statement to their source of support being clear when they state such things clearly on their web site and stop the kind of smears I saw in response to the Pando article. I mean, here's people taking money from CIA and/or affiliates openly speculating that someone saying so or implying it means something must be... working for CIA, a fascist, or something in a smear job. Repeat, people paid by vicious, authoritarian regimes they claim to fight accusing someone of evil or connections to such regimes for reporting their source of funding. Unreal... I'll be interested to see how long popular support for Tor lasts if it's marketed as a former Navy tool currently supported by CIA and State department groups. The reality probably will change the perception of it and when/where to use it a lot. I still support the project as realists like me know it's a double-edge sword they need to work but might try to compromise in limited ways. Hence, me pushing strong security engineering to be applied to it.

frunt 10y ago

What a histrionic, over-emotional mess these people are. With personalities like that, it's a wonder any meaningful work on Tor gets done.

ethbro 10y ago
Agreed on one hand. But on the other hand, these are literally (as noted in the log) people who have physical security concerns travelling to a large part of the world if their identities are public. Only paranoia if your laptop doesn't get seized at customs every time you fly, etc etc.
ocdtrekkie 10y ago
People are likely to act much differently when facing an "existential threat". Certainly for the guy worried this could get his family killed, but even just for people who've invested years of work into the Tor project, and think this could lead to it's downfall. For something like Tor, userbase has a particularly key role in maintaining the project. This is likely something to do with the instinctual "fight or flight" response. I think you can see people who chose each in this chat log.

Aelinsaar 10y ago

I like to think that most people don't expect something like TOR to protect against a determined government. That doesn't make TOR useless, since I suspect that most people are not trying to be anonymous from intelligence agencies, only law enforcement agencies.

tptacek 10y ago
Hasn't Tor already demonstrably failed to protect people from US law enforcement? Tor is an important research project. But that's what it is.
- jimktrains2 10y ago
  Are you talking about the current FBI case? That was an exploit in the Tor Browser Bundle (could force the browser to make a request using the non-tor network), not in the Tor Network itself.
  - tptacek 10y ago
    No, I was referring to the FBI hidden service de-anonymization attack from last year.
    - deleted 10y ago
      [deleted]
    - belorn 10y ago
      You mean the Flash based NIT exploit, as part of Metasploit? Flash which is by default off in TBB and has really nothing to do with tor, is actively discouraged by the tor project, and is in strong decline world over? Or are the talking about the Carnegie Mellon attack that modifying Tor protocol headers? If so, is that fixed security bug enough to judge tor as failure and only usable for research? Even seatbelt, which has a fairly simple concept, had initial issues and are still being improved. On the topic of the Carnegie Mellon attack, the tor project both addressed the protocol header bug and changed their security practices. Strange activity in the tor network has in the past been deemed safe until proven harmful, but as a result of having an research university doing attacks on users of the network, that practice has been reversed and strange activity is now deemed harmful until proven safe.

deleted 10y ago

[deleted]

gnu8 10y ago

Why are we letting USG people be involved with anything? Anyone with a current or former association with the military-industrial complex should be blacklisted. These people are nothing but trouble; they are ideologically untrustworthy and very likely beholden by both carrots and sticks to government interests. They're unfit to be involved in any project but especially those with security implications to the average person.

atdt 10y ago
For one: because much of what we know of the surveillance capabilities of state actors and the ways these capabilities are being used, we owe to whistleblowers like Edward Snowden, Chelsea Manning, and Thomas Drake.
- bsjsjjdjdjj 10y ago
  ^ this.
- eternalban 10y ago
  "what we know of the surveillance capabilities Correction: What you have been told.
ashitlerferad 10y ago
How do you know USG people aren't infiltrators from Tor/etc?

shruubi 10y ago

Don't want to drag up the whole Jacob Applebaum thing again, but just the way he talks in these logs makes me wonder how anyone could tolerate working with someone who keeps saying things like "I did X, I did Y". It's surprising that it seems like only Isis really stood up to his line of questioning while the rest kind of fell silent.

fapjacks 10y ago
He is insufferable! Exactly the kind of person that makes at least half of Freenode so awful to participate in.
- cocotino 10y ago
  +1, this is just typical irc behaviour.
anonbanker 10y ago
you're surprised that most of the channel agreed with him?
e12e 10y ago
For other's not up to speed, I take it Jacob Applebaum's nick is the same as his twitter handle, ioerror.

libeclipse 10y ago

At one point they say that the CIA would do and say anything to keep an agent's cover. If so, then why would they send an agent in who's openly admitting to being an agent?

anonbanker 10y ago
he lied and said he was from the state department first.

rasz_pl 10y ago

There is no such thing as 'ex-CIA agent'

SEJeff 10y ago
Correct, the title is "Officer" of the "National Clandestine Service", a part of the CIA. Source, I worked with some spooks in Iraq when I was US Army Military Intel (UAV was then changed to Aviation after I got out).

anonbanker 10y ago

After reading this, I'm pretty sure I understand why Appelbaum is getting bombarded Assange-style with rape/harassment allegations: He single-handedly acted as the voice of reason in this conversation.

mercuryIntox 10y ago
> ioerror: I shut down the city of san francisco to stop the war > ioerror: Once, I was deported from Lebanon for being jewish, which was because htey said i was a spy for israel (false) > ioerror: If we have a CIA person working with Tor, I won't get out of that next time, I fear I sincirely hope you are being ironic.
- anonbanker 10y ago
  I fail to see how your quotes discount anything I say. Do you have evidence that he wasn't deported for being jewish, and that having CIA ties to Tor wouldn't cause him injury? Do you have evidence that he didn't hack SF infrastructure as hacktivism?

raverbashing 10y ago

Why are they using IRC instead of something like SILC? Or is this an internal IRC channel that's only accessible using TOR (or maybe something else?)

ivraatiems 10y ago

Is there a breakdown somewhere of who these individuals are/what their relationship to the project is? I find that more context I'm missing might help me understand.

kriro 10y ago

I can't quite connect the dots...how is the involvement of the ex-CIA guy putting the family of one of the people in the logs in (more) danger? It's already CIA funded so any government that wants to torture people for using Tor can already legitimize that practice (but tbh why would they even bother) since they are "using CIA-software" or whatever reason you want to give. I feel like I'm missing a logical step here. I do think ex-spies should not be involved in the project and the insistence of DaveC1 is really odd (as is joining before getting clearance to say he was CIA...why not get that first then ask if he can join). Why isn't he coming to the conclusion that it is probably a bad idea and he can get involved in other ways. Do we know who leaked this, is it more likely to be someone on the pro or contra ex-CIA-involvement side? Logically it makes no sense for say mrphs to leak this, right?

tor-internal 10y ago

Here is a list of people in the chat by username. Info on what each of them does at Tor is at https://www.torproject.org/about/corepeople.html.en https://www.torproject.org/about/corepeople.html.en asn: George Kadianakis atagar: Damian Johnson athena: Andrea Shepard DaveC1: David Chasteen gamambel: Moritz Bartl helix: Erinn Clark ioerror: Jacob Appelbaum infinity0: Ximin Luo isis: Isis Agora Lovecruft Julius23: Julius Mittenzwei Lunar^: Lunar mikeperry: Mike Perry mrphs: Nima Fatemi puffin: Karen Reilly Phoul: Colin Childs qbi: Jens Kubieziel Runa: Runa Sandvik sekritarma: Roger Dingledine sysrqb: Matt Finkel weasel: Peter Palfrader yawning: Yawning

crumpled 10y ago

RE: Those reactions from mrphs and ioerror Apparently TOR's reputation can be utterly destroyed and result in loss of life by something as simple as a person trying to join the team. Who knew? They claim that just by approaching them he did damage, why didn't they think of this before? Just send agents to offer to write blog posts, watch the devs flip out and revoke their keys. Seriously, if that's all it takes, you have bigger problems.