September 2000 - cypherpunks-legacy

CDR: Bruble2 address change
by Admin of Bruble Anonymous Remailer 29 Sep '00

29 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- New address is bruble2(a)email.si Old address is still functional, there is forward to new address. The only change to key is in the name (email.si) Have nice time. Config line here is provisional. To see current configuration options supported by this remailer, use the subject: remailer-conf $remailer{"bruble2"} = "<bruble2(a)email.si> cpunk mix hybrid middle pgp pgponly latent ek ekx esub cut hash repgp remix ext max test inflt150 rhop5 klen400"; Public keys for the remailer: RSA Key 0x70204517 Anonymous Remailer <bruble2(a)email.si> - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: N/A mQCNAzkDXFYA/AEEAMw3XzV1RZEOVTFy+IsyFnWz9vZyK9htc5d7WZVTG/DcYiRT LMfmejd/2oHp0sypPpfR9mpG+6rAiGbys/1coP4tf/NeaQQkjbjsEjfliZN7NtqS nKDQ7CtTQtBztRftQbpYZb9VpLx/r/d3f1VdQV4NLAiFESHVbKCtiqBwIEUXAAUR tCVBbm9ueW1vdXMgUmVtYWlsZXIgPGJydWJsZTJAZW1haWwuc2k+iQCVAwUQOdTM JaCtiqBwIEUXAQHXqgP+Oh0pA17qSosbI622enjLjraRnPih3MrNwnWtGO1SDUkG 9j88aIDyZ7/gYNlpdTtwO7lLprCF+2zY4bsNkDYual2i6wMBuzaxK+KeQ0evBPRa ee/Q5pT3JJ4zar0ob6KGaKsORaO8NVuhKUjGwGXkor2khkyy/gOROE5+VwqfrB4= =OYxv - - -----END PGP PUBLIC KEY BLOCK----- DH/DSS Key 0xCEEE22BF Anonymous Remailer <bruble2(a)email.si> - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: N/A mQGiBDkDW9QRBADhJstLQ+1rUvw/FF01sX9Y06OCjn5R5Njki6o8fQ9rY5C0lUWs nv2Q60w9izzcDWjxbCEcPG8LImLFUMP+2gN7trDIBKi9VzO7fJ3CDmCfxyTOHsis CHWfJiMLNow0VBd67Wvofy8hQ3L/EaJ3CDt6Df9l5vAllcxG+q6Dh/Uk0wCg/6Vq iv9wCpWBIgQpD9DP7x/eQ7EEAIi4mFsKsSB8wTmDyjDnTUR4zyYXtVUYkhUt8cyy yCRIJzKHxiEfOn0+frBqEzgHPW2CEjbPm90C8bIgOdYUgrjU713l+0Em4KaPGJto aul0P9TfO5/g14x3ze9QdErYk2ZzcL0lvLui298O4RccXGMKImUlca2c3FNt3ldC 9V7FBACKD6viqnDfSXzTOQ4n6RFh/ViiheGooDPsNvut1X52GFob6mP23ZjLqa36 GKAmlhSU62jKkuRprGfOx5Kg3AXV5Iu+KzoHJ7Sh6i3Mshgn30BQCW9preExJIPD vW1lCkWhYWznKeBY+r6MpolTH6HttCoUE6XyUk+jxamn3oHKXrQlQW5vbnltb3Vz IFJlbWFpbGVyIDxicnVibGUyQGVtYWlsLnNpPokAUQQQEQIAEQUCOdTLyAUJAUw6 AAQLAgMBAAoJEFukAjTO7iK/FHsAn2sUGs3DMiAi++3D3bB7QMagsOdlAJ4yeF+O OizzsM4XuRsPYvvztoPOzbkBDQQ5A1vWEAQAw5p1KRxQZOtA3eOKS5gVz4aEvCFA toIsXJD9nZyUgX7IUTZmhnflZKOkoE3aTV60N47nK8fg07+O/zMH7U7fkc2OloIF TnlcJWfbHpU47f/Q7pEVWG1KQGv8vJmDmrvDQxK12mGky44QYHP0X8SBdg//F9yr S1SdPRt5jqSpsPkAAgID/2fscZ4f3C9Z+5GVGtD3yuHChhBN3mjIlTDdbqgwz+V7 SG3RvU3MB9Yow1oBW8LINucuWsskCB+ojkZB77GpCIYPw1dI2WnyCsIZ+LnbAYcv yMPSkMzgJVpSlOv8CXTzYdDhju+wMY95BdkKo4DriP5YVgMi495a/mXgD0fl8QLq iQBMBBgRAgAMBQI5A1vWBQkBTDoAAAoJEFukAjTO7iK/nx4AoO0ffs1FQYpj/HUd jAItLu8ov7wdAJ0VCQnviwbnrIPRcfc5lFRYUE6/0Q== =gpF9 - - -----END PGP PUBLIC KEY BLOCK----- MIX Key bruble2 bruble2(a)bigfoot.com 7ad11b915168ca2da64830cae3bde210 2.0.4b45 MC bruble2 bruble2(a)email.si 7ad11b915168ca2da64830cae3bde210 2.0.4b45 MC - - -----Begin Mix Key----- 7ad11b915168ca2da64830cae3bde210 258 AATkOn1OXlmEfn8pMMX0X5mKiwR8amrB5PjB+iLk UbcezYLhAbgUBQRgK2nMVySfJz/TEfUKqUjzY6o/ Rgy7sISoDz+YzlCKehS7l1l3WHrYRMY0zo/5sPhe QaTVHuAUfqaJ6RQs5SgJGIPKeG3YrK+PVvic+J/J hyveUAq6ciqpKwAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAQAB - - -----End Mix Key----- - -----BEGIN PGP SIGNATURE----- Version: N/A iQEVAwUBOdPNdbjwkQXxOXLNAQE7ZQgAlf6GLbz+LGZu8rVy5VMgGsgyyeMUPxVg K9f+nBFqMmB3+ftT7Cz+xwnygha8AHdb2BVfiLxmkwV4TCn9BoH/EFGGolChWepz 851/A/ZP8tvRSLe1At6JwsMo/T2XP90TyS/33+lKsI9xyd/c7fgjd60xsteR2tfE jrqR0eEoPv0PYG7nvfDqU6h2ZXqH6NFaXGcI5rFk1Q5bmwMOq+oREiWHk3I6e7Tz JQcFOeVE//MI5Kuy2MHPovNQTGFk2X4kp4P71OICPDXEBh2QCBUFNY48iDBP0OzE 3fAb+WkrX2ibC/jGqo1P6ywcL3o4+q/q1b2URQTqvgrpEXJZ/xNBzw== =Dfa0 - -----END PGP SIGNATURE----- ~~~ This PGP signature only certifies the sender and date of the message. It implies no approval from the administrators of nym.alias.net. Date: Fri Sep 29 20:20:05 2000 GMT From: bruble-admin(a)nym.alias.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBOdT5ek5NDhYLYPHNAQFnvQf/XZOmE3zeUech40m9KmxqeoXrmi++0BJW ZdZV/0pW1JyEghDPgrceNtMejKh9NtxgelnZO35Ow6GYuttsmwad6CnChMDPWCqV wCuEGrHOFKjcMvXIrhhz0SIrdi8GMRNMakbdQmwEsZSZHoo/zLvfsep2OxLNP1xO g0HB23zAVyIBIwY+ZdKsRgbRqeOyTaMwK+jvT08nQ0ny1kddRwNnOea1upGVPgwF lgztxeZK2f7ZevkUOGJF1lHJJ0kFREBG5DeHSFw277Mvjqu/aupGc7dAeFpTkKXs YdaeKzKGW4KCCAKfQv73p12PrdvRyUTEdueFmkXW13rgTGMSB6hCTQ== =OTdJ -----END PGP SIGNATURE-----

1 0

CDR: Tim May goes bush shooting.
by Gary Jeffers 29 Sep '00

29 Sep '00

http://www.inet-one.com/cypherpunks/dir.2000.08.21-2000.08.27/msg00157.html "...you are _probably_ either ML or GJ." Well, that almost flew under my radar:-) Hey, I don't do anon. flames of Cypherpunk regulars. Hey, watch out ML. You're next. ================= ================= http://www.inet-one.com/cypherpunks/dir.2000.09.18-2000.09.24/msg00148.html ++++++++++++++++++++++++ ++++++++++++++++++++++++ http://www.inet-one.com/cypherpunks/dir2000.09.18-2000.09.24/msg00167.html Bush Shooting: There is a breed of deer hunter who, when hearing a noise in the woods, fires into the bush in roughly its direction hoping that it may be a deer and that he may hit it. :-) Yours Truly, Gary Jeffers Beat State!!!!!! _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

1 0

CDR: Of Huns and throats
by Nomen Nescio 29 Sep '00

29 Sep '00

from _Onwards to Victory_, Cassell edition, page 100: "The proud German Army has by its sudden collapse, sudden crumbling and breaking up...once again proved the truth of the saying, 'The Hun is either at your throat or at your feet.'" -- Winston Churchill, speech to the United States Congress, 19 May 1943.

3 2

CDR: RE: visor phone vs. starium?
by Tim May 29 Sep '00

29 Sep '00

At 11:18 AM -0400 9/29/00, Trei, Peter wrote: > > >I have greater hopes for doing encrypted voice-over-ip, if we want >something that 's open source and user-verifiable. > A 3-way Cypherpunks physical meeting was DES-encrypted over the MBONE in 1993. Mountain View (CA), Cambridge (MA), and Vienna (VA). Audio quality was sketchy, especially with speakerphones being used, so we ended up turning off the DES. Got a little better, but not much. So, I'm surprised that more than 7 years later this isn't more common. (Confirming once again that Moore's Law is often applied carelessly and means less than some think it does.) Speaking of the Starium, I have the earlier version. It suffers from the "fax effect": those one wishes to communicate with using it must have one, obviously. Very few people do. A good solution for specific groups who can buy N of them and distribute them to all in their group. But not a standard. The Visorphone will also be subject to this, vis-a-vis a crypto module: most users will have Something Else. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

1 0

CDR: RE: Lions and Tigers and Backdoors, oh, my...
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > From: Michael Motyka[SMTP:mmotyka@lsil.com] > Using an embedded system is not a new topic here. I think its the only > viable method of securing data. > > On that note, given the little wireless gizmo of Tim's description, the > device could have, via appropriate applications on the insecure > host/transport gateway, access to a services on the host that would > expand its list of resources without compromising security. The obvious > useful resources are the network and mass storage though other i/o might > be interesting. All storage of course would be encrypted and never > available as plain text on the host. Any i/o used should not carry > information that is to be kept private, only as a means to transport > non-critical data into the PDA. > > What is required is a PDA that is open sourced all the way down to the > HW. Is the Palm this way? I think I've asked this before but frankly I > don't remember the answer. There are probably others that are OK. Yopy > looks interesting. Which ones will still be around in a couple of years? > Full source code for the Palm OS is available to registered developers (who have signed an NDA). It's not too difficult to become a registered developer. The only PDA I know of which is open source for HW & SW is the Itsy, but a number (Palm, iPAQ, etc) have had Linux ports. Peter Trei

1 0

CDR: RE: Bad Coding Practices
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > From: Steven Furlong[SMTP:sfurlong@acmenet.net] > Reply To: Steven Furlong > Sent: Thursday, September 28, 2000 9:00 PM > To: Multiple recipients of list > Subject: Bad Coding Practices > > "Trei, Peter" wrote: > > <<NSA et al inducing a company to write bad crypto software>> > > > 2. Individual treachery. > > > > This type involves corrupting one or more engineers, whether via money, > > threats, or misplaced appeals to patriotism. This is more likely to > > succeed in the short term than type 1, but is very fragile for several > > reasons familiar to anyone who has done commercial software development. > > > > * Peer code reviews mean that many eyes look at the code. > > * Employee turnover in the field is high - 30-50% year. Thus, bugs > > inserted by earlier compromised employees are unlikely to > > last through many release cycles, as new employees come in > > and say 'Oops - Joe forgot to init the PRNG properly - lets fix > > that!' > > * Source code management systems make it very difficult to a single > > actor to monkey with code secretly, and even harder to cover his > > tracks. > > I'm less sanguine. What follows is mainly based on my experience as a > consulting or contract programming, but it matches the comments of other > programmers. I've never worked at a company which made privacy software, > though several companies rolled their own crypto for their products. > > - Code review? What's that? We can't waste time having programmers look > over each others work. Besides, we don't want to make it look like we > don't trust them. > > Even in shops which did have code reviews, they usually consisted of > Johnny-on-the-spot explaining in broad terms what a function did and > going over a piece of which he was particularly proud while everyone > else nodded sagely while thinking about their kid's soccer practice. I > wouldn't want to testify that any of the "reviewers" had even read the > code before or during the meeting. > My comments on code reviews is based on the practice at my current employer. When upper management supports the practice, and not only allows, but in fact requires engineers to take the time and effort to do real reviews, they can catch a remarkable number of errors. It also means that more than a single engineer is familiar with a given piece of code, which is a Good Thing. > - Depending on the shop, code which is difficult to understand may > remain untouched for years. So long as it does what it's supposed to do, > or its shortcomings can be compensated for at lower immediate cost than > rewriting the blob, many places just leave it be. The code chunk might > well be looked at by many eyes, but they'll all roll up before making > much headway. So the moral for the subverted programmer is to write his > poison pill very badly and don't explain how it works. > This is a real potential problem - old code that hasn't been looked at in years. Re-writing from spec every few years is one solution, but one that is rarely implemented. > - Many places I've worked have been too cheap to buy a version contol > license for every developer, so everyone just logs in as PVCS and checks > in changes. And hardly anyone looks at the comments, except to scan for > comments like "Fixed bug #521". > Clearly, you've worked in places with shoddy (and possibly criminal) practices. > Now, I think your general point is right, that it would be somewhat > difficult for a subverted programmer to insert deliberately broken > crypto, and a very bet to expect it to stay in for any length of time. > However, if the privacy software companies operate anything like the > companies I've worked for or consulted at, it could well happen. > Eavesdroppers in and out of uniform will look for, and try to generate, poor practices which will break otherwise secure systems. What I find most worrying is when management only pays security lip-service, a bullet item for marketing, without any real desire to make it strong. Lucky's discovery that some GSM phones in the US have lousy or non-existant keying practices is one example. I've actually turned down jobs from firms where I felt that they wanted crypto as a bullet item rather than for real security (one place wanted to use 20 bit keys, for example. (they no longer exist)). Peter Trei > Disgustedly, > SRF > > -- > Steve Furlong, Computer Condottiere Have GNU, will travel > 518-374-4720 sfurlong(a)acmenet.net > >

1 0

CDR: Re: More Columbine fall-out
by Secret Squirrel 29 Sep '00

29 Sep '00

Steven Furlong wrote: > ALBANY - Schools will be required to submit copies of their building > plans to local police and fire departments under legislation recently > signed into law by Gov. George Pataki. I wonder if this includes home schools.

1 0

CDR: Exciting News from Dialpad!
by Your Friends at Dialpad 29 Sep '00

29 Sep '00

Dialpad.com Newsletter Volume 1, Issue 1 ***********************Advertisement*************************** This newletter is sponsored by: NetFlip. Get $200 in minutes! Click here! http://click.dialpad.com/dp12354576.240.0.131 *************************************************************** Dear Joe, Thank you for subscribing to our monthly Dialpad.com newsletter. Our newsletter features our latest products, press releases, and tips to make your Dialpad experience the best it can be. Also, please join us in thanking our advertisers. They keep our basic service free through banner advertising. So, if you're online and you see an ad that interests you, please click on it. Clicking never disconnects your calls. The more you click, the more we can improve our services and keep Dialpad free! For questions about our service, visit our Help section at http://click.dialpad.com/dp12354576.240.0.114 where you will find answers in our FAQ's and Dialpad web searcher. We hope you enjoy our service and continue to make free long distance phone calls from your PC to anywhere in the U.S. Regards, Brad Garlinghouse Chief Executive Officer, Dialpad.com P.S. Don't forget to tell your friends about Dialpad! DIALPAD CHECKLIST We've put together a checklist to make calls using Dialpad easier than ever! - Does your keypad not appear? Download the latest JAVA VM here: http://click.dialpad.com/dp12354576.240.0.116 - Still not getting a keypad? Try clearing your cache file. Click here http://click.dialpad.com/dp12354576.240.0.114 for directions.If it still doesn't appear, try downloading the latest version of your browser. - Not sure how to make a call? Check out our tutorial at http://click.dialpad.com/dp12354576.240.0.114 - Hearing an echo? Perhaps it's time to buy a headset from our new dialpadStore at http://click.dialpad.com/dp12354576.240.0.118 THIS MONTH'S FEATURES Here are some of the new features to enhance your Dialpad experience! dialpadStore - Check out the latest e-products in our new store! http://click.dialpad.com/dp12354576.240.0.105 Firewall Reflector - Use Dialpad at work or at home! http://click.dialpad.com/dp12354576.240.0.106 PC-to-PC calling - Call your friends whenever they are on-line! http://click.dialpad.com/dp12354576.240.0.107 Skins - Change the look and feel of your Dialpad applet! http://click.dialpad.com/dp12354576.240.0.108 Dialpad Agent - Launch Dialpad from your desktop! http://click.dialpad.com/dp12354576.240.0.109 **********************Advertisement*************************** Get $200! Click here! http://click.dialpad.com/dp12354576.240.0.131 ************************************************************** DID YOU KNOW? E-commerce - You can save 20% at the new dialpadStore. Just enter coupon DLPD2 at checkout and receive up to $10 off headsets, electronics, and many other great products. Firewall Reflector - Our new patent pending technology facilitates voice data travel across company firewalls, personal NAT and other IP sharing environments. If your company or home firewall blocked Dialpad in the past, give it another try! One-click calling from the phone book - By entering names into your personalized phonebook, you can dial your friends directly with one click of the mouse. Dialing method - You do not need to enter a '1' when entering a 10-digit phone number. You can also make phone calls using letters such as 800 FLOWERS. Capacity - Our capacity is continually being expanded to support our unprecedented growth. That means no more busy signals and less congestion. ***********************Advertisement************************** Make over $200 in minutes! Earn cash by completing offers. Click here! http://click.dialpad.com/dp12354576.240.0.131 ************************************************************** To unsubscribe from this newsletter, simply reply to this email with "Remove" in the subject line.

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0