October 2000 - cypherpunks-legacy

CDR: Re: why should it be trusted?
by brflgnk＠cotse.com 20 Oct '00

20 Oct '00

It was said: -- begin quote -- >As to care, as I've said a lot before, care is most often more >expensive than coverage. Clearly this can't be true or every health insurance company would be going out of business. Coverage has to be more expensive than care of they wouldn't be in the business of providing coverage. -- end quote -- You've missed the essential gamble of insurance: care given to an individual insured party is usually more expensive than the premiums paid by that individual. The gamble is that the aggregate premium collected from all the insured in the pool will exceed the aggregate cost of care for those in the pool that collect benefits. That the insurance business is profitable proves the gamble usually pays off.

1 0

CDR: NYT Account Request
by forgot＠lga2.nytimes.com 20 Oct '00

20 Oct '00

You have requested your ID and password for The New York Times on the Web. Please follow the instructions below. If you have any questions or problems, write to forgot(a)nytimes.com. Please DO NOT REPLY to this message. 1. Please make a note of your subscriber ID: sciferpunk 2. Next, to change the password for this account, using your Web browser go to this unique URL: http://verify.nytimes.com/guests/forgot/forgot?key=40177689_16329707 This page will allow you to choose a new password. Make sure you have copied the address EXACTLY as it appears here. (If you're getting an "Error" page, the address was probably entered incorrectly. See "Help With Copying and Pasting" at the bottom of this e-mail.) 3. Follow the instructions on the screen to choose a new password. After you have entered a password you will automatically enter our Web site. The New York Times on the Web Customer Service forgot(a)nytimes.com ******************** Help With Copying and Pasting 1. Using the mouse, highlight the entire Web address, (e.g. http://verify.nytimes.com/guests/forgot/forgot?key=40177689_16329707) shown above in step 2. It's essential to highlight the entire address, even if it extends over two lines. 2. Under the Edit menu at the top of your screen, select "Copy". 3. Go into your Web browser (open it if it's not already opened). 4. Click in the "Netsite" or "Address" bar -- the place in your Web browser where it says what Web address you're currently looking at -- and delete the address that's currently there. 5. In the blank "Netsite" or "Address" bar, paste the address by selecting the "Edit" menu at the top of your screen and choosing "Paste". 6. Press Enter. 7. Follow the instructions to choose a new password. ******************** If you did not request your ID and password for your NYT Web registration, someone has mistakenly entered your e-mail address when requesting their password. Please simply ignore this message, or, if you wish, you may go to the address above to select a new password for your account.

1 0

CDR: Re: Non-Repudiation in the Digital Environment (was Re: FirstMonday August 2000)
by Ed Gerck 20 Oct '00

20 Oct '00

Bob Jueneman wrote: > Let's put this problem in perspective, and try to avoid the "chicken little, the sky is falling" syndrome. > > It's quite unlikely that someone would come up with "Eureka!" type of solution to factoring large numbers that would end up completely breaking RSA, or that some way would be found to completely break the integrity of SHA-1. Well said. SHA-1 works as a many-to-one function and this alone makes it impossible to break if well applied. Simply, no global inverse function exists for a many-to-one function (even though a local inverse may exist, but in this case SHA-1 would not have been well applied). This is a mathematical fact. Matters with RSA are still unproven, though, but it is not probable that it will be broken any time soon in a wide scale. However, this is not what concerns me at all. PKI is the problem. It does not work and it will not work on a global scale. E-commerce itself has moved away from PKI for no other reason. The problem then is the E-sign Act and state legislation following on its heels, which not only blurs IMO what a digital signature is but also does not deal adequately with the liability issues for the different parties involved. In this scenario, what if we see a blind push for a global PKI and also include non-repudiation as an "absolute authentication" based on some mythical "trusted machines" -- as has been suggested recently in the good name of e-commerce? Cheers, Ed Gerck

1 0

CDR: ADL lists anarchy symbol as racist
by anonymous＠openpgp.net 20 Oct '00

20 Oct '00

http://www.adl.org/hate_symbols/racist_anarchy_symbol.html

8 9

CDR: Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)
by Bob Jueneman 20 Oct '00

20 Oct '00

Let's put this problem in perspective, and try to avoid the "chicken little, the sky is falling" syndrome. It's quite unlikely that someone would come up with "Eureka!" type of solution to factoring large numbers that would end up completely breaking RSA, or that some way would be found to completely break the integrity of SHA-1. Instead, we would be much more likely to see a nibbling around the edges, and a gradually decreasing confidence in existing algorithms, with more than enough time to replace them. In fact, we have already seen that. MD2 is now deprecated, and MD5 is being pretty widely supplanted by SHA-1. Likewise, DES has been broken and people are recommending that triple-DES be used, and soon AES. And OAEP is recommended to get around some hypothetical million-question attacks. But the sky hasn't fallen, and the sun still comes up in the morning. Even if some catastrophic weakness were somehow revealed that any high school kid could take advantage of with a single PC, there are still checks and balances. The kid still has to have money in the bank to pay for the item, and all of the usual velocity checks, etc. that are used to combat fraud would still be in place and would work. And good old-fashioned detective investigations and forensics would still be applicable. Any good security system has defenses in depth, and is not subject to the balloon-popping problem. that doesn't mean that we shouldn't try to make systems be as perfect as possible. But if they aren't (and they never are), that shouldn't be the end of the world as we know it. Let's not invent a hypothetical Y2K problem. Bob Robert R. Jueneman Security Architect Novell, Inc. -- the leading provider of Net services software. >>> Tony Bartoletti <azb(a)llnl.gov> 10/19/00 04:09PM >>> At 04:58 PM 10/19/00 -0400, Arnold G. Reinhold wrote: >>Yes, that is why Tony's remark was somewhat tongue-in-cheek and used >>"solid mathematical foundations" within quotes. > >Eye twinkle doesn't come across in e-mail, I'm afraid. My apologies to >Tony. This is obviously one of my hot buttons. No problem. I often employ a quoted "x" to convey "so-called x", a shortcut that can lead to misunderstandings. >>>It is all hypothesis and empirical argument. A lone >>>mathematician working in his attic could come up with an algorithm >>>that would blow some or all of the existing systems out of the water. >>>Who get to cover that financial risk? >> >>The buyer. CAs (read Verisign's CPS or any CA's CPS, or bank contracts >>and -- above all -- see the US UCC) are not responsible for producing correct >>results but just for using correct methods. Where "correct methods" are >>what others consider correct -- even if they are proved wrong later on >>by a one mathematician working in his attic. > >I'm not sure those contracts would stand up in court if there were massive >public losses due to a collapse of the PKI. (Anyway CA CPS's stretch to >notion of a "mutual agreement" pretty far. I purchase a $10 cert and am >bound by over 100 pages of gobbldygook that only a handful of people on >the planet can be expected to fully understand?) > >But I am less concerned with CA legal liability then with who is left >holding the bag when a massive subversion of the banking system is >perpetrated, and how big that could be. I'll wager the taxpayer/consumer will foot the bill, one way or another. Derivative to the Second Law of Thermodynamics, it is easier to destroy wealth than it is to create it. So, on average, work/energy is required to create or recreate wealth. The collapse of a future global PKI, or of the integrity of banking transactions, would represent a huge shift from order into chaos, a decoherence of identities and orderliness amounting to a huge destruction of wealth. Recovery thus will require the recreation of wealth, in one form or another. This will require a correspondingly huge input of work. So, who does most of the work, in general? You know the answer ;) ___tony___ Tony Bartoletti 925-422-3881 <azb(a)llnl.gov> Information Operations, Warfare and Assurance Center Lawrence Livermore National Laboratory Livermore, CA 94551-9900

1 0

CDR: Encryption export rules finalized
by George＠Orwellian.Org 20 Oct '00

20 Oct '00

See: http://www.pscu.com/Newsbytes/2000/156920.html http://www.nandotimes.com/technology/story/body/0,1634,500270563-500421503-…

1 0

CDR: I created the "Al Gore created the Internet" story
by Declan McCullagh 20 Oct '00

20 Oct '00

http://www.wired.com/news/politics/0,1283,39301,00.html The Mother of Gore's Invention by Declan McCullagh (declan(a)wired.com) 3:00 a.m. Oct. 17, 2000 PDT WASHINGTON -- If it's true that Al Gore created the Internet, then I created the "Al Gore created the Internet" story. I was the first reporter to question the vice president's improvident boast, way back when he made it in early 1999. Since then, the story's become far more than just a staple of late-night Letterman jokes: It's now as much a part of the American political firmament as the incident involving that other vice president, a schoolchild, and a very unfortunate spelling of potato. Poor Al. For a presidential wannabe who prides himself on a sober command of the brow-furrowing nuances of technology policy, being the butt of all these jokes has proven something of a setback. I mean, who can hear the veep talk up the future of the Internet nowadays without feeling an urge to stifle some disrespectful giggles? It would be like listening to Dan Quayle doing a please-take-me-seriously stump speech at an Idaho potato farm. Case in point: Mars Inc. lampoons the vice president in a hilarious new commercial for Snickers. In it, a cartoon Al brags that he, variously, invented the Internet, trousers, and when he wasn't busy elsewhere, "lots of other stuff too." When you're getting mocked by a candy company, you know your statesmanship rating has plummeted to a terrifying new low. No wonder one recent poll shows Gore to be solidly ahead of his Republican rival in only 11 states. It's simple: He's got no respect. Which brings us to an important question: Are the countless jibes at Al's expense truly justified? Did he really play a key part in the development of the Net? The short answer is that while even his supporters admit the vice president has an unfortunate tendency to exaggerate, the truth is that Gore never did claim to have "invented" the Internet. During a March 1999 CNN interview, while trying to differentiate himself from rival Bill Bradley, Gore boasted: "During my service in the United States Congress, I took the initiative in creating the Internet." That statement was enough to convince me, with the encouragement of my then-editor James Glave, to write a brief article that questioned the vice president's claim. Republicans on Capitol Hill noticed the Wired News writeup and started faxing around tongue-in-cheek press releases -- inveterate neatnik Trent Lott claimed to have invented the paper clip -- and other journalists picked up the story too. My article never used the word "invented," but it didn't take long for Gore's claim to morph into something he never intended. The terrible irony in this exchange is that while Gore certainly didn't create the Internet, he was one of the first politicians to realize that those bearded, bespectacled researchers were busy crafting something that could, just maybe, become pretty important. In January 1994, Gore gave a landmark speech at UCLA about the "information superhighway." Many portions -- discussions of universal service, wiring classrooms to the Net, and antitrust actions -- are surprisingly relevant even today. (That's an impressive enough feat that we might even forgive Gore his tortured metaphors such as "road kill on the information superhighway" and "parked at the curb" on the information superhighway.) Gore's speech reverberated around Democratic political circles in Washington. Other Clinton administration officials began citing it in their own remarks, and the combined effort helped to grab the media's attention. Their timing was impeccable: In July 1993, according to Network Wizards' survey, there were 1.8 million computers connected to the Internet. By July 1994, the figure had nearly doubled to 3.2 million, a trend that continued through January 2000, when about 72 million computers had permanent network addresses. Small wonder, then, that as the election nears, Gore's defenders have been rallying to defend him. In a recent op-ed piece in the San Jose Mercury News, John Doerr and Bill Joy claim "nobody in Washington understands" the new economy as well as Gore does. Net-pioneers Robert Kahn and Vint Cerf, a Democratic party donor, have written an essay saying "no other elected official, to our knowledge, has made a greater contribution over a longer period of time" than the veep. Scott Rosenberg, in a recent Salon article, joined the fray: "The 'Gore claims he invented the Net' trope is so full of holes that it makes you wish there were product recalls for bad information." It's also true that, as a senator, Gore in the 1980s supported universities' efforts to increase funding for NSFNet, a measure that became law in the High Performance Computing Act of 1991. Gore's guest columns in Byte magazine at the time showed an appreciation of technology that was far from usual on Capitol Hill. But it's also difficult to argue with a straight face that the Internet we know today would not exist if Gore had decided to practice the piano instead of politics. By the time Gore took notice of the Net around 1987, the basics were already in place. The key protocol, TCP/IP, was written and the culture of the Net had blossomed through Usenet and mailing lists, as chronicled in Eric Raymond's Jargon File. At best, Gore's involvement merely hastened its development. Instead of the orderly interstate highway system that Gore had repeatedly used as metaphor, the spread of the Net has resembled something closer to a self-organizing, almost anarchic sprawl. Instead of a government/corporate-controlled system that might have looked like France's wretched Minitel system -- or, more charitably, a 500-channel interactive TV network -- the Net's popularity grew because of far more mundane applications like email and downloading porn. And it's fair to say that other Gore pet projects, like the Clinton administration's abandoned Clipper chip, are hardly ways to protect privacy and security online and promote the development of this technology. Then again, it's also true the Clipper chip was first concocted under a George Bush Sr. administration, and another Bush occupying the Oval Office might well have similar inclinations. We know that George W. Bush may not be any tech-savvier than Gore -- as anyone who caught the governor's the-Net-made-them-do-it comments about the Columbine High School killers can attest. But he seems to have successfully neutralized Gore's advantage on tech issues. In the first debate, Bush jabbed at Gore during a figure-rich discussion of HMO coverage. The delivery was wooden, but it was no joke: "Not only did (Gore) invent the Internet, but he invented the calculator," Bush said. The big surprise was not that Bush used the quip. It has, after all, also shown up in his stump speeches and Republican jibes. No, the surprise was that Gore remained silent. When he had a chance to respond, Gore only talked about prescription drugs: "You can go to the (Bush) website and look. If you make more than $25,000 a year, you don't get a penny of help under the Bush prescription drug proposal." At least he mentioned a website. ###

12 25

CDR: Tim May's anti-semitic rants
by auto9950013＠hushmail.com 20 Oct '00

20 Oct '00

This list is no stranger to Tim May's sarcasm and anti-semitic rants. >You just used a German word. I'm reporting you to the Zionist League. >"Remember, children of Israel, "Eretz Israel" is not the same thing >as "lebensraum," and the suppression of the ragheads in Eretz Israel >is merely pest eradication, not the "Final Solution." War is peace, >freedom is slavery, and Zionists are libertarians." --Tim May

4 3

CDR: Re: Insurance (was: why should it be trusted?)
by James A.. Donald 20 Oct '00

20 Oct '00

-- At 01:42 PM 10/20/2000 +0300, Sampo A Syreeni wrote: > Details, details. People use the term 'anarchy' a bit too casually > here, nothing else. Mostly what they mean is 'libertarian'. The > latter in no way excludes other hierarchical relationships, as we > all know hardcore anarchy does. Tim's favorite characterization of > this side of anarchy is something like socialist simp-wimp mumbo > jumbo. Anarcho socialism has been dead since 1938. (It had the misfortune of being actually tried in 1936, whereupon it instantly became apparent that socialism requires a vastly powerful state in order to apply ruthless terror.) Today's "anarcho" socialists, such as Chomsky, believe that the best way to arrange for the state to wither away is to first make it vastly powerful and all encompassing. Where have we heard that theory before? --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG tD7Rz9+AcnJbU8ma1SUnADe5oj9i+3cuYAlz3GAo 46+a0dJNvfetkNC2myPgoVrhbdqK0GQ+hdsCVmGm/

1 0

CDR: Re: It's all property, folks
by No User 20 Oct '00

20 Oct '00

Neil asked: > Same deal. I'd rather it not be polluted in the first place. > And how do I sue some one if there is no judicial system or government to > enforce the > decision. "Joe's International House of Justice" ? Most EarthFirst! folks have figured out that you just have to forget about the government acting properly to protect Mother Earth. It takes direct, individual (or group) action to do it. Thus came about ELF - Earth Liberation Front -- and ALF, Animal Liberation Front. You probably recall some of their work -- Vail, for instance. My problem with them is that they try to not hurt humans, which is stupid. No, you don't sue -- you get a gun and/or a car bomb and kill some of the assholes. Kill the CEO of the polluting company. Park a car bomb outside the factory and detonate it in the midst of shift change. They'll get the message. And here's where crypto comes in -- read up on Jim Bell's Assassination Politics. People who don't like pollution can act anonymously and pay off the hit men. Sweet, savage, but sweet! Your neighbor pollutes your lungs or your land and you don't know what to do about it? Shit man, get real -- $5 bucks worth of gasoline and a midnight stroll takes care of his house, him, and his family.

3 2