June 1993 - cypherpunks-legacy

Re: News Bytes June 8, 1933
by peter honeyman 09 Jun '93

09 Jun '93

some interesting stuff here -- a little whistle-blowing here, a little clipper punching there ... peter ------- Forwarded Message Date: Tue, 8 Jun 93 13:02:07 -0400 From: rweingar(a)cs.UMD.EDU (Rick Weingarten) Message-Id: <9306081702.AA18515(a)tove.cs.UMD.EDU> To: adrion(a)cs.umass.edu, basili(a)cs.umd.edu, corbato(a)xx.lcs.mit.edu, patterson(a)ginger.berkeley.edu, pfreeman(a)gatech.edu, mrg(a)research.att.com, cwg(a)research.nj.nec.com, ashok(a)almaden.ibm.com, weiser.parc(a)xerox.com, wulf(a)virginia.edu, wise(a)seafox.cs.indiana.edu, tony(a)ide.com, forsythe(a)cs.UMD.EDU, jh(a)cs.cornell.edu, greg(a)cs.arizona.edu, johnsson(a)think.com, klawe(a)cs.ubc.ca, kung(a)harvard.edu, mji(a)guardian.cs.psu.edu, lazowska(a)cs.washington.edu, leveson(a)ics.uci.edu, steve.muchnick(a)eng.sun.com, jrr(a)cs.purdue.edu, ritchie(a)hplabs.hp.com, jes(a)cs.brown.edu, denning(a)cs.georgetown.edu, jwerth(a)cs.utexas.edu, phayes(a)herodotus.cs.uiuc.edu, policy(a)cs.UMD.EDU Subject: News Bytes June 8, 1933 Computing Research News Bytes by Juan Antonio Osuna with Rick Weingarten 6/8/93 GAO Criticizes ARPA on Architecture Research The General Accounting Office released a report in May (GAO/IMTEC- 93-24), criticizing the DoD's Advanced Research Projects Agency for its handling of the High Performance Computers and Communications program. Some researchers have criticized ARPA for procuring only Intel and Thinking Machines supercomputers for use by ARPA projects, while ignoring machines manufactured by other companies.. GAO cleared ARPA of the harsher accusations of serious misconduct, but upheld this general criticism, saying that such a narrow focus has inhibited R&D by other supercomputer manufacturers. The report suggested that ARPA should seek advice from a broader range of researchers who do not directly participate in ARPA projects. Finally, GAO said ARPA needs to give more emphasis to software development, which in the past has been given lower priority than hardware. ARPA claims it has already fixed many of these problems.. GAO is now planning a follow-on study looking more broadly at program management and support for high performance architecture research in all agencies.. House Appropriations Subcom Gives NSF an 11% Increase [elided] "Clipper Chip" Proposal Draws Public Criticism The Clinton Administration's recent proposal to implement the Clipper chip as a government encryption standard is receiving a cold welcome from some in the computer community. During a three-day meeting before the Computer System Security and Privacy Advisory Board of the National Institute of Standards and Technology, dozens of people from academia, industry, and civil liberties groups expressed disapproval for the way the White House is trying to implement its cryptographic policies. Complaints were directed in three directions---to the technology, to the process of selecting the standard, and to the civil liberties implications for Federal wiretapping. The Administration initiated a public review after, rather than before, declaring Clipper as a government standard and ordering thousands of Clipper devices for government use. In light of the negative reaction, the advisory board passed a resolution to extend public review and voted to hold another board meeting in late July. The board also decided to send a letter to the White House to relay public concerns and to suggest tactfully that the president reconsider the Clipper scheme. Amendments to HPCC Act Move Forward [elided] ------- End of Forwarded Message

1 0

AT&T Encrypting Phone Ad in WS Journal
by binski＠u.washington.edu 09 Jun '93

09 Jun '93

FYI The Wall Street Journal, 7 June 93, page B7, has an AT&T ad for an encrypting communications box called "Surity Telephone Device". It plugs between a regular phone and the phone jack. Anybody know what's inside? Is this new? Also, page B6 has a so-so article on digital signatures. bf

2 1

Statement of dissatisfaction with your recent efforts (fwd)
by Mark 09 Jun '93

09 Jun '93

Probably shouldnt have, but they get on my goat. Forwarded message: >From mark Wed Jun 9 10:59:04 1993 >Subject: Statement of dissatisfaction with your recent efforts >To: cert(a)cert.org >Date: Wed, 9 Jun 1993 10:59:04 +1000 (EST) > >Dear cert et al, > >It has come to my notice recently that your organisation has been >involved in a number of accusations against individuals and organisations >with very little to back such accusations. > >I am referring to, and these are the ones I will mention here, the >soda.berkeley.edu and the anon.penet.fi sites., both of which ARE >legitamate in all respects and are SEEN as such by the net.community. >Your organisations actions, in my personal opinion, consititute a form >of harrassment of the worse kind, and it basically smells. > >Whilst any one with any knowledge of your workings already knows the >low quality of feedback, lack of helpfulness and general arrogance of >your methods, it doesnt do you any good at all to set about on a >crusade of self-serving actions against those sites or entities or >groups of individuals you dont like or you see as furthering ideas >and software that might one day make your life difficult. You will >alienate a larger proportion of the net.community than you otherwise >have. > >I would suggest in future you take the time to VERIFY, through whatever >legal means are at your disposal, the authenticity of your information, >to view yourselves the problems/files and then take whatever action your >charter states as appropriate. Going off gun-ho and sending ominous form >letters to people you see as gullible enough to carry out your desires >really is less than professional. > >I fail to see where you get authority for a large proportion of your >actions, but that is a matter between you and your financiers. Just dont >expect people to take you seriously if the above scenarios are repeated. > >The above is my own personal observations and not those of any other >individual or organisation, although they are free to explicitly echo >them if they so desire. As of yet, none have. > >Mark. >mark(a)cheops.anu.edu.au

1 0

Re: CERT
by jet＠nas.nasa.gov 08 Jun '93

08 Jun '93

peter honeyman writes: > jet wrote: > > I personally like being contacted by an organization trying to tell me > > that someone might be misusing my computing resources. > how would you feel about an organization telling your boss that > your actions were contributing to the abuse? I wouldn't care given my current boss(es). If my boss were the sort to believe a vague form letter and take action w/o consulting me, I'd want a different boss anyway.

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by nobody＠cicada.berkeley.edu 08 Jun '93

08 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- This "coincidence" brings a name to mind. Rhymes with "turn right." Starts with S. What could I be thinking? DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBFAgUBLBUF/fFZTpBW/B35AQEFfQGArv/awBslh2T7ybcjtiiiT9Ew3wxPz3Vv od0hAFCl5L0VFOA1MczZozJWf4xH0nFM =LNm6 -----END PGP SIGNATURE-----

2 1

CERT and us
by fnerd＠smds.com 08 Jun '93

08 Jun '93

hey folks a poem by fnerd It looks like CERT may have a habit of sending accusatory-looking form letters without doing much checking of their own based on who knows what tips. Looks like they need to polish their policies and their prose a little bit. BUT We, too, are a group formed to look into problems of computer security. We, too, respond to security emergencies. We, too, distribute patches to help people improve their security. We, too, send messages--even rumors--back and forth about threatening situations and people we suspect. Sure, our style and emphasis are different, but our charter is very similar to theirs. Let's not let our name or style distract us from our mission or blind us to potential allies. Instead of thinking of them as the heavies and us as the rebels, WHY NOT us as the net-wise older brothers, and them as the enthusiastic amateurs who need some advice and calming down? Eric can write one of his authoritative letters, and we become the voice of reason, the watchers of the watchers, Liberty's eyes. Gentlemen and ladies (I reproach you), remember who we are. -fnerd quote me

1 0

New PGP Version?
by Kent Hastings 08 Jun '93

08 Jun '93

New PGP Version? Here goes with ANOTHER stupid newbie question: What's the latest PGP version? I have DOS and Mac copies of version 2.2. Is there an e-mail accessible group like this for PGP or crypto in general? I see references to sci.crypt on occasion. Is that easy to get, or do I have to do fancy-smancy things with archie, ftp, usenet, and other Greek words? (I have docs for archie, and will soon have UUCP decode software, but I haven't figured out all this complicated, user-hostile stuff quite yet). I DO know IBM MVS/JES2 JCL, and because there is nothing more difficult to use, I am confident that this Internet jive will seem trivial someday. Kent - kent_hastings(a)qmail2.aero.org#000#

1 0

CERT
by Clark Reynard 08 Jun '93

08 Jun '93

I was disgusted and horrified to read that PGP had been removed from soda, and gratified to find that it had been returned. However, your experiences with CERT are not unique. As could be expected of any agency directly funded by Air Force Intelligence, CERT is a genuinely ugly organization which needs to be stamped out. Frankly, it's a menace to society. Examine their acronym. Computer Emergency Response Team. What a fucking joke! Excepting the Morris Worm, can you name a SINGLE Computer Emergency which CERT has halted? It is simply an organization to keep the crypto-fascists wired into the net. I will assume, as you did not say otherwise, that you do not know the name of the CERT person who reported you, for whatever ridiculous reason. This is standard practice for CERT; it's customary for them to hide behind a shield of anonymity for the purpose of attacking people. My life was severely disturbed three years ago due to similar anonymous tips from CERT, and I have yet to discover the identity of the CERT person who tipped off the authorities to me. CERT is yet another agency which is freed of Constitutional restraints for a vague and undefined 'public good.' If distributing PGP, legal in the entire Free World except for the US, is a "Computer Emergency," then I'm a fucking Republican. Combat this so-called Computer Emergency Response Team wherever you see the tendrils of its evil influence. ---- Robert W. F. Clark "Be sand, not oil, in the machinery rclark(a)nyx.cs.du.edu of the world." Gunter Eich clark(a)metal.psu.edu

8 9

Re: ALERT / My email address is...
by TO1SITTLER＠APSICC.APS.EDU 08 Jun '93

08 Jun '93

Well, actually, it's not even a hack to find out who the subscribers are... You simply use the EXPN command in the SMTP protocol to find out who the recipients of a list are. This is documented in RFC-821. However, the cypherpunks list requires a little bit of ingenuity, or familiarity with sendmail. I periodically get a copy of this list, just in case. Last I checked, there were 409 names on the list. Two were files, about ten or fifteen were either other lists, fidonet echos, or local USENET newsgroups. The rest appeared to be real people. Most of the apparent lists listed on the cypherpunks list were not traceable thru SMTP EXPN. If you desire real privacy, I suggest that you get the cypherpunks list, figure out which ones are hidden lists, and ask to subscribe to those. If it is desired, I can send a list of these lists to the cypherpunks list. Kragen

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by smb＠research.att.com 08 Jun '93

08 Jun '93

steve, like eric, i feel that cert is overstepping their charter by engaging in law enforcement activities. what's your feeling on the matter? don't you agree that this could jeopardize their ability to do the work they are chartered to do? Law enforcement? It's law enforcement if they do more than notify the owner of the site. Most such sites welcome the notifications *if* (and it's a big ``if'') their machines are being abused by outsiders. If CERT is going out and looking for pirated software, or if they try to take any action to enforce their notes -- then, I do agree with both of you; such actions are beyond their charter. (Though one can argue that clandestine distribution of malware would fall be an exception. I specify ``clandestine'' because one could entertain a reasonable suspicion that the motives of such distributors was not purely educational...) If you asked CERT to justify such notes, they'd probably quote the following text from their press release on ftp.cert.org: It will also serve as a focal point for the research community for identification and repair of security vulnerabilities, informal assessment of existing systems in the research community, improvement to emergency response capability, and user security awareness. ``User security awareness'' sounds about right. Look -- CERT did not demand that the ftp area be shut down, they did not threaten to cut the machine off from the Internet, they didn't (as far as I know) turn the note over to the FBI or the Secret Service, and they didn't mention PGP or ``dirty GIFs''. They simply *informed* the administrator, in a polite way, of information that that administrator probably wants to hear. (I've had occasion to notify various system administrators of the same sort of thing. They were all grateful for the report.) The overly-hasty response came from Eric's end. What the administrator's response should be if RSADSI sent a note about PGP is another matter. This is CERT, and they're talking about pirated software. --Steve Bellovin Disclaimer: I'm on friendly terms with CERT, and with a lot of the folks who work there. And -- as anyone who has read my papers knows -- I've sent in my share of incident and vulnerability reports.

2 1