July 1993 - cypherpunks-legacy

State Dept. shuts down DEC machine
by L. Detweiler 13 Jul '93

13 Jul '93

A very hot topic (and one of my favorites to track) on this list is the shutting down of various sites due to various factors. I'd be interested in hearing more of the BBS shutdown cases here, which are oft-rumored on Internet but rarely discussed authoritatively. Anyway, here's some strange actions by the State Dept. in shutting down a DEC FTP site. I wonder if this was *after* that little DES FTP retrieval demonstration before congress--did that give some people ideas? Anyway, this is disturbing, and the question always is `is this an isolated action or a trend emerging'--if hostility reaches the people who are responsible they are unlikely to do it again; even ivory tower bureacrats have a large CYA instinct (that's how they get there and stay there). Note that this was NOT the DECWRL machine but another at DEC. ===cut=here=== Subject: State Dept. shuts down open-access Internet DEC-Alpha via export ctl! Date: Thu, 08 Jul 93 01:34:07 -0700 From: gnu(a)cygnus.com DEC was the first company to put up one of their machines on the Internet so that people could log in and port their (free or commercial) software to it. This is a great idea, which I'm encouraging others to emulate. But the government objects... The machine was called axposf (AXP is the model, OSF is the operating system) .pa.dec.com (in the Palo Alto office of the DEC computer company). Anyone could connect to it over the Internet, using a standard protocol (telnet), and type to it, as if they were sitting at its console. This was WONDERFUL for people who are working on software. The AXP is a new "64-bit" machine, and most software will need at least minor revisions to accomodate it. But most software authors and companies won't immediately buy an AXP. Making one available for casual use on the Internet means that much more software would appear on the AXP sooner. The State Dept. regulates "remote access to computers" as equivalent to "export of computers". I shudder to think what would happen if they discovered that ordinary email can invoke processing remotely. Unfortunately, the machine is at DEC, which is gunshy about export problems, after getting a multimillion dollar fine (which I don't think they ever challenged in court) because some customer trans-shipped a Vax to Eastern Europe in the '70s. A more modern company might simply tell the State Dept. to shove it, and beat them in court over the unconstitutionality of the export laws. Are they seriously telling us that we can't put a public access machine on the Internet? Can we attach phone lines to it instead? If not, a few thousand BBS's running on fast machines are violating export laws... If so, what is the specific difference between the Internet and a phone line, that lets a company distinguish a legal act of commerce or communication from an illegal act of export? John, can you make sure the Congressional committees hear about this? As far as I know, they are still not on email. John Gilmore ------- Forwarded Message Date: Wed, 7 Jul 93 02:12:04 -0700 From: paul(a)vix.com (Paul Vixie) Message-Id: <9307070912.AA15402(a)gw.home.vix.com> To: gdb(a)cygnus.com, mike(a)mbsun.mlb.org Subject: fyi ... I helped set up axposf.pa.dec.com before I left DECWRL, and I know that the U. S. State Department demanded that it be shut down since there were no access controls to prevent foreign nationals (even those we are not friendly with right now, e.g., Iraq) from telnetting in and getting access. Since the DEC Alpha machines fit the legal description of "supercomputer", this access amounts to "exporting munitions" even though the hardware doesn't move and the crypt(3) sources aren't online. Anyway the service is down right now and the relevant folks at DECWRL and DECNSL are working hard to get it back up again but meanwhile there are no guest DEC Alpha ("AXP") machines on the Internet just now. [gw:i386] telnet axposf.pa.dec.com Trying 16.1.0.14... Connected to axposf.pa.dec.com. Escape character is '^]'. OSF/1 (axposf.pa.dec.com) (ttyp1) login: axpguest Password: Login incorrect login: Connection closed by foreign host. [gw:i386] date Wed Jul 7 02:00:08 PDT 1993 - -- Paul Vixie "Be neither a conformist or a rebel, <paul(a)vix.com> for they are really the same thing. decwrl!vixie!paul Find your own path, and stay on it." (me) ------- End of Forwarded Message To: farber(a)pcpond.cis.upenn.edu Subject: Re: When did the DECWRL machine get pulled off the net? Date: Thu, 08 Jul 93 12:13:41 PDT From: Paul A Vixie <paul(a)vix.com> it happened about two months ago, while i was still brian reid's employee. note that DECWRL is still there, it's the corporate internet gateway. what got taken off the net was an AXP-OSF/1 guest machine. the state department said it was legally a supercomputer and since dec could not guarantee that folks on the SD's DNP ("denied parties list") (Iraq, for example) would be prevented from using it, they insisted that the machine be shut down. we got the notification from the lord-high-weenie of dec's legal department, and since they more-or-less outranked us we had to pull the machine off the net. i don't work for dec any more so i'm free to discuss this. brian reid, my old boss, is not free to discuss this. the whole thing makes me really really angry.

2 1

pgp patent.
by J. Michael Diehl 13 Jul '93

13 Jul '93

Hi all, just a quick question. Exactly when does the patent expire which will make pgp legal? Enquiring minds want to know? ;^) +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Mailer tests
by M..Stirner＠f28.n125.z1.FIDONET.ORG 13 Jul '93

13 Jul '93

Just a quick note to say that I sent out a packet of tests for the remailers via the RBBSnet UUCP gate following the standard Cypherpunks form: To: remailer(a)some.place.edu :: Request-Remailing-To: me(a)my.address.com This is a test of the ... remailer... I sent this message to each of the following: hh(a)pmantis.berkeley.edu hh(a)cicada.berkeley.edu hh(a)soda.berkeley.edu phantom(a)mead.u.washington.edu 00x(a)uclink.berkeley.edu remailer(a)utter.dis.org I received the test message via the remailer(a)utter.dis.org quickly & without problems. I have yet to get the other messages, nearly a week later. With the exception of remailer(a)utter.dis.org, all of these have been habitually unresponsive to regular tests. I have been able to get the soda remaier to work once, & with the efforts of the remailer operator, was able to get the phantom remailer to work once. I have been unable to get the anonymus+info(a)charcoal.com remailer to accept mail after some six attempts. The Charcoal daemon bounces back the messages as coming to an unknown addressee. The Extropia PGPed remailer seems to work well, as does the hal(a)alumni.caltech.edu remailer. Nearly everything else seems very iffy. Which remailers claim to be able to mail directly to newsgroups? ********************************************************************* * <m..stirner(a)f28.n125.z1.fidonet.org> - PGP Key D30909 via servers * * > What country can preserve its liberties if its rulers are not <* * > warned from time to time that their people preserve the spirit <* * > of resistance? Let them take arms!" - Thomas Jefferson, 1787 <* ********************************************************************* ___ Blue Wave/QWK v2.12 -- M. Stirner - via FidoNet node 1:125/1 UUCP: ...!uunet!kumr!shelter!28!M..Stirner INTERNET: M..Stirner(a)f28.n125.z1.FIDONET.ORG

1 0

SMTP, PINE, and security
by greg＠ideath.goldenbear.com 13 Jul '93

13 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- me <uunet!Cloud.Cuckoo.Land!root> writes: > One of the many neat features of PINE is that it allows one to talk > to the SMTP server _directly_, bypassing sendmail (and its security checks). > What this means is that instead of doing a "telnet xxxx smtp", you can > build and configure a PINE client to do it for you, and retain all the > nice features. PINE source code is freely available, and does not require > root privs to run (any more than it requires root privs to "telnet xxx smtp") [stuff deleted] > If that happens, the days of EZ phreaking are over..... I dunno; if things change such that it's considered normal for users to connect to local or outside SMTP and NNTP ports, that would seem to create an convenient smokescreen/excuse for folks who use those ports for their own (non-approved) ends. It'll be a lot harder to look through a log for unknown connections. See the discussion on comp.dcom.telecom about how difficult it is to provide authentication of cellular phones and fraud prevention, while allowing people to buy new phones easily, roam, and do all of that other stuff that people do. I think the SMTP/NNTP/PINE/whatever stuff is very similar - I think it may prove so difficult to truly authenticate unknown and untraceable users that people will turn to other means for identifying a few trusted machines/people/processes. Public-key crypto, perhaps? :) Security and convenience are basically incompatible; I'm hoping that we opt for convenience. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEEIfn3YhjZY3fMNAQGVfwQAoestrAnd168C061KVqb+znRBFNoAIS1k Ic7JtsVxzj9xaFc5v5nKDUgHD4g47ulTyc1jqEFKmUjfqfal5xZVhN+/4wHFaN0v 2gNbYByvd7/QL685+lkGGkFr1ff7qTdWqVk5LV6b4fRyhJcTHIH48x/55QO0Oo3y DYdA6GDuChk= =SOFw -----END PGP SIGNATURE----- -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

2 1

Re: anonymous mail
by dmandl＠lehman.com 13 Jul '93

13 Jul '93

> From: jet(a)nas.nasa.gov (J. Eric Townsend) > > nobody(a)entropy.linet.org writes: > > that somebody can get fired for views expressed in a private > > e-list, which probably extrapolates to USENET posting as well. > > Apparently, Mr. Steshenko forgot to include the "disclaimer: my > > opinions" with his email. > > Apparently, Mr. Steshenko thought it was appropriate to use company > resources for non-company activities. On top of that, those > activities misrepresented the company. > > Steshenko's firing is something all the libertarians on this list > should applaud. This "libertarian" (note small "l"--if you mean "Libertarian," you should be more careful in the future) doesn't "applaud" Mr. S's firing. What a stupid thing to say. You should either be fried by your more humane Libertarian colleagues, or (if there is general agreement with your message), you should be declared the Missing Link that some of us have been searching for for years. This is so typical. If the State had pulled something like this, you'd be screaming your head off, but when a "private" corporation does it, you not only don't protest, but actually cheer them on? This is just the kind of rigid, stupid, pro-authoritarian thinking that many people expect from the more zomboid Libs, though we rarely get to see anyone display it so candidly. Looking at your email address, I notice that you're an employee of mine. I strongly disapprove of your using this ID for your own leisure activities. However, I'm a nice guy, so I'll give you, oh, two more chances. Then, you're out of here. Direct all flames anywhere but dmandl(a)panix.com or dmandl(a)lehman.com. --Dave.

2 1

please send cypherpunk mail to me at
by nate＠VIS.ColoState.EDU 13 Jul '93

13 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Please send the CP mail to me at nate(a)vangogh.vis.colostate.edu I am having problems getting the CP mail forwarded to me, and this may very well help. thanks, - -nate +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger me at nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | "I have but one single desire - to tear down the sky" -A. Toomba +----------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEGIb9Tgi1fmrpxlAQFMOwP9Gq8DUzldiPDSfRRrlBCjRKBAyXU9fZ8z 6wOBelKJqVNHwgDBOMDkgKWe0iSwANT1/yJ0szcOZmERT9pod75HGzHtDogNGyfL 4ZjrqVCtAA95Y+HnyTfGQ7Ej86NEqRaN8F+hE7ZqwurtCYBf3Ag0jES4iI/YvjbN bSPpjSPItPA= =PkJT -----END PGP SIGNATURE-----

1 0

Help! not getting any CypherPunk mail!
by nate＠VIS.ColoState.EDU 12 Jul '93

12 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Help! I am not getting any mail from the CypherPunks mailing list, although my posts are apparently getting through OK. Please help! thanks, - -nate sammons +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger me at nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | "I have but one single desire - to tear down the sky" -A. Toomba +----------------------+ -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEFtRtTgi1fmrpxlAQFzyAP8C6V9nVURq13bPYPa+FPnCFiYc71wAKKI o+t1HGdcylMuY24lKk+UhI2yEMO/JEyqDYJnpeOV6kn+izfx4OyrWLVmN7rYD4Nf Yr8wb18+3Zd9cFPsn6QwSLzd/2XVY+tmzrIMwVShmgIAl2gobuScey+q7JBK3j8X ImzeUJF20Hw= =Y2eB -----END PGP SIGNATURE-----

1 0

Re: Radical Paranoia?
by dmandl＠lehman.com 12 Jul '93

12 Jul '93

> From: J. Michael Diehl <mdiehl(a)triton.unm.edu> > > Lets say someone emails me a key and the return address matches that of > the address in the key. Do I assume no one is spoofing me? You have to > admit that this is possible albeit unlikely. What good is key certification > if it only "probably valid?" I've noticed that many of the keys on the > server are signed with the same person's key. I doubt that these people > have had physical contact with each of the people who's key that they've > signed. Am I just being paranoid, or is there a valid issue here? I > welcome any of your comments. Anything is possible. It's best to play it VERY safe when it comes to certifying or accepting keys. The ideal thing is to accept only keys that have been signed by a key you know to be good. Start with a key that's been handed to you personally (or that you are absolutely certain is legit), and work from there. Some folks (bless them) have signed oodles of keys and are very trustworthy; if you can work through the web to them eventually (being careful along the way about who you trust as a certifier), you'll eventually have a windfall. No, most people on the public servers have probably not met face to face; they've worked their way to each other using trusted signatures and certifiers. Just be careful about who you trust. --Dave.

1 0

"Data Haven" def
by edgar＠spectrx.Saigon.COM 12 Jul '93

12 Jul '93

Patrick E. Hykkonen Inquired: Could someone please define a 'data haven'? I understand digitial cash, it is exactly what it sounds like. However, in the context I've heard data haven used in, then there is much more than simply keeping one's data encrypted on your local hard drive. Webster's Seventh New Coll. Dict.: Haven: 1: HARBOR, PORT 2: A place of safety :ASYLUM My analysis: A "data haven" is some entity where data can be placed and have some assurance against either accidental or deliberate destruction. Encrypted data on your hard disk is safe enough against -disclosure-, but is very vulnerable to destruction, either accidental or deliberate. Certain individuals and governments have such strong views on certain forms of data that they will destroy them if they even suspect encryption is hiding such data. A data haven would ensure such data could not be destroyed without permission of its owner. The owner might or might not permit distribution of the data either free or for a fee. Examples of data at risk for deliberate destruction: Pornography, especially child ponography. According to recent news, a BBS in Denmark (Holland?) may be a data haven for that. Politically incorrect programs. For example, the German government is trying (and may have succeeded) to destroy all copies of a game program called "Concentration Camp Commander". This was on the news a few months ago. The USA would be a data haven for this program, generally speaking, since as political speach it would be protected by the First Amendment. (But I don't know if any copies have ever made it here; I net-chat with a few people in Europe & none of them have ever heard of it.) -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Radical Paranoia?
by wcs＠anchor.ho.att.com 12 Jul '93

12 Jul '93

Email is *not* enough. Easily forged, easily intercepted, not secure. This mail could be coming from me, it could be coming from the NSA, it could be my cat jumping on my keyboard's function keys triggering emacs form-letter-mode. No way to tell. Cat already dumped my password and modem dialcodes into this mail message, and he's still pretty young :-) Building and maintaining a web of trust means we're all responsible for signing keys carefully, and making sure people know how careful our signatures are. Read through the READMEs a couple more times until you really understand the procedures! My view is that you should only sign a key if you really *know* that the person whose key your signing is that person and you've verified with them that you've got the right key. If somebody *you recognize* hands you their key, fine - I recognize about 10 or so well-known cypherpunks that I could do this with (plus other people who might be interested but aren't verbose contributors here :-) On the other hand, if Vesselin Bontchev asked me to sign his key, I wouldn't do it, because I don't know him by sight, unless somebody I know knows him personally introduced us. If somebody you know by *voice* wants you to sign their key, you'd better at least have a voice telephone call with them where you read key fingerprints over the phone. This is how I had Phil sign my key, and there are 3-4 others here I could probably do this with if I wanted. When you're adding people to your PGP keyring, pgp asks you how well you trust people to sign keys. You can trust me to do that much for identifying people, but on the other hand I've got a diskless workstation as the only thing I have that can do PGP until I get it on my wife's laptop, so you can't trust that my keyring hasn't been hacked -- that's why my pgp userid says "multiuser" in it. I really won't feel comfortable signing keys until I've got a secure system and we've got an RSAREF implementation that makes use of RSA kosher. If you're likely to sign keys for people you don't really know well, such as giving out starter PGP floppies at a trade show or rave or something, I suppose you could generate a separate key/userid that says it's not very secure, signed by your regular key, but do try to at least check easily-forged ID like driver's licenses for people you don't know, and encourage them to generate real keys and get them signed by people that *they* really know. It's not ideal; do people feel that's acceptable to get people initial connections? Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0