December 2001 - cypherpunks-legacy

Re: Steganography, My Ass: The Dangers of Private and Self-Censorship in Wartime
by mattd 12 Dec '01

12 Dec '01

>>"the public responsibilities of >the press are a myth." It's entirely possible to reconcile that phrase >with the idea that a newspaper is a for-profit business. Especially if your a two headed dog.I cant believe the crap assfluff,cheney and the drongo are putting over you people. They tell you to fly ,fly, fly then warn you next day were all going to die,die,die.Of course its all a lie,lie,lie. Assfluffs a stumbling peccary about to fall into the piranha pool.You can fool some people... The lies about technology and the net remind me of wermacht soldiers at stalingrad giving a massive salute while saying 'the shit in berlin is up to HERE!"

1 0

cryptographic fantasy (ca. "Stego, my ass" by WF Buckley)
by Dirk Boxcuttah 12 Dec '01

12 Dec '01

The notion that Osama would use a filmed interview to send out recondite commands is cryptographic fantasy. William F. Buckley Jr. OSAMA THE INVINCIBLE http://dailynews.yahoo.com/h/ucwb/20011211/cm/osama_the_invincible_1.html

1 0

Re: UPI editor: dissent is like soviet propoganda
by jamesd＠echeque.com 12 Dec '01

12 Dec '01

-- James A. Donald: > > For example the viewer sees CBU-15 described as nerve > > gas. The viewer then sees Moorer and the interviewer > > talking about a battle in Laos, then there is an editing > > cut, and then the viewer sees: On 10 Dec 2001, at 14:53, Declan McCullagh wrote: > I don't think your summary is correct. CNN hired an outside > reviewer who came up with this report, which recommends > retraction of the story but accuses the reporters of no > malice: http://www.cnn.com/US/9807/02/tailwind.findings/ "No malice", not "no lies" The reason he concludes "no malice" is that he concludes the reporters really believed the US had used nerve gas, not because he believes the reporters had truthfully reported the evidence. The edited Moorer seemingly admits to the use of nerve gas, and another witness seemingly admits to personally massacring civilians. In the unedited versions, they do not. The reason it was "no malice" is that the reporters actually had some evidence -- but not evidence persuasive enough to report on television. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG LU0N6i897F7dj1cMd1Rd3z4T8cvfH/3QdF6Yx98j 4B2ygdObW0RForD1jMTcV2PBVSHc8W09z7xvkq3y9

2 4

: Re: AP Al Qaeda
by mattd 12 Dec '01

12 Dec '01

On Wed, 12 Dec 2001, Declan McCullagh wrote: > Without getting into any AP discussion, I would point out that there > are some positive things to be said about turning to property taxes. > > Also, if you fail to pay your property tax now, it will (in extremis) > be confiscated. Armed resistance to confiscation would be met by > escalation, including, if necessary, >military helicopters. So the property you own is really(!) owned by the state and you pay the initial payments for title transfer and the taxes during occupation (sounds like rent doesn't it?) unless you default in which case they take their property back... Seems to me the ideal strategy is to not own anything of significant value. "Aint got nothing,got nothing to lose" A lot of barristers have gone bankrupt lately,It hasn't cramped their billing style though.This threads veering into socialistic territory,Im telling jamesd! Also AP comes out of tax revolt,dont try and separate it out,declan.Start a new thread on property taxes.Im taxing the land where the cato institute stands,btw.If I dont get 100,000 k per annum I send in my new OSD black helicopters.

3 2

Re: AP Al Qaeda, the wrath of choate!
by mattd 12 Dec '01

12 Dec '01

Get your damn quoting right, Declan didn't right the '> >' delimited text as you indicate. Get this right dickhead.Im here to annoy you,declan and any other cypherpunk I feel like.Your fancypants,the lotta youse. (cept peter trei)

1 0

Re: Professor Punished for Witty Remark
by mattd 12 Dec '01

12 Dec '01

>>Compared to giants like Brookings? Not well-funded, well-known, big, nor powerful. Few folks even in DC have heard of it. $1M in grants over a period of years is not much by Washington policy group standards. -Declan Compared to so called "libertarian" institute,Cato,that comps our resident bottom feeding scribbler this is low?high?middling? Right wing conservative 'think tanks' serve a useful purpose for the fascist corporate state.Corporations need manufactured consent as much as Govt.Especially when so many of them are so much bigger than many Govts.Ive made several posts re.the notorious cato institute,the most damaging linking declan through it to the murder of george harrison.As I said to agent faustine,declan,silence speaks volumes in this house.

1 0

Slashdot | Free Software And Its Revolutionary Social Implications
by mattd 12 Dec '01

12 Dec '01

>>Those in the audience that are freethinking and not jingoistic Jamesd help me out here! This crappy kraut wants to quote MARX! This choate guy,when he's not baffling with flying saucer bushit,is a motherfucking COMMIESYMP! maybe even a COMMIE! Im not joking,he is clinically insane.

1 0

Choate vs mattd [was: RE: The fucking essay]
by Trei, Peter 12 Dec '01

12 Dec '01

This should be fun to watch. Let's hope the result is similar to the matchup of the Kilkenny cats. "There once were two cats of Kilkenny Each thought there was one cat too many So they fought and they fit, And they scratched and they bit, Till excepting their nails and the tips of their tails Instead of two cats there weren't any." Peter Trei

1 0

Re: The fucking essay
by mattd 12 Dec '01

12 Dec '01

>>Clearly you've NEVER actually talked or read a psych book in the last 50 years. David Cooper,rd Laing,Konrad Lorenz,bf,Skinner,Erricson on identity.Dibs in search of self.whReich,steinem. Some of those I read ages ago but I read new scientist regularly and for the last 15 years.Freud is as discredited as comprehensively as marx.IMHO.Freud invented the sub conscious and marx,surplus value.Yeah right.give us a fuggin break Im not pretending to be expert on anything,Id like to be a sorta heinleinian guy.Allrounder,master of none,blah blah,etc,etc. Im also kinda interested in the psychology of people with flying saucers links at their websites,could you help us out?

1 0

Re: [linux-elitists] Phil Zimmermann on key exchange (fwd)
by Eugene Leitl 12 Dec '01

12 Dec '01

-- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBMTO: N48 04'14.8'' E11 36'41.2'' http://www.leitl.org 57F9CFD3: ED90 0433 EB74 E4A9 537F CFF5 86E7 629B 57F9 CFD3 ---------- Forwarded message ---------- Date: Tue, 11 Dec 2001 19:37:52 -0500 From: David Shaw <dshaw(a)jabberwocky.com> To: linux-elitists(a)zgp.org Cc: Seth David Schoen <schoen(a)loyalty.org> Subject: Re: [linux-elitists] Phil Zimmermann on key exchange On Fri, Dec 07, 2001 at 11:42:26PM -0800, Seth David Schoen wrote: > > So Phil's robot CA idea actually sounds more practical to me than > > Brad's idea; in particular, it has better compatibility with regular > > PGP encryption -- and it seems that it may be more robust in some > > ways. The robot CA is intuitive and fairly secure if you don't expect > > active MITM attacks. > > The Board of Directors of EFF met today in San Francisco, and I made a > presentation about this, in the presence of Brad Templeton and others. > One of the conclusions was that EFF's role in implementing something > like this is still not defined clearly enough, and we don't know what > we could most usefully do. > > For example, some people like the idea of standardizing protocols > through the IETF; others prefer a completely independent development > of a spec (possibly with advance commitments or at least expressions > of interest from vendors), and then submission to standards bodies > after the technical work is more of a fait accompli. There is some > disagreement about who exactly should write which code, for what > platform, and what effect it would have for different people (e.g. > famous cryptographers, civil liberties organizations, well-known > scientists or network engineers) to endorse various approaches in > various places. > > We want to figure out more about what EFF can best do to make this > happen. Brad Templeton is planning to write to Phil Zimmermann, and I > plan to write to Phil Karn and some other people. After the Zimmermann article appeared, I emailed him and we spoke on the phone for a few hours about the possibilities here. He's an interesting guy. We discussed some concerns I had with the robot CA concept as without client support, or a special robot keyserver along with (or part of) the robot CA, there are some problems. All in all, I like his ideas for the robot CA (he had some ideas to extend this to a robot "designated revoker" as well as a few other useful things). > Brad was concerned that the robot CA is a single point of failure and > an easy target for attacks (DOS, subpoena, physical intrusions); it > _does_ hold some secret and trusted information (its own private > signing key) and also has a uniquely valuable key which can be > compromised -- an event which would tend to undermine the entire > scheme. He added that both schemes are equally secure against passive > wiretapping, and the scheme he outlined can survive even if the > organizations which originally supported it go away. One possible way to address some of Brad's concerns with Phil Zimmermann's scheme is to create a meta-key, stored offline, with some rigidly followed procedure for its use (this should be analogous to a non-robot CA master key handling). Use this key to sign a number of additional keys[1] for each robot CA. This gives you a few improvements - one, you have more than one robot CA, all equally valid, so there is no longer a single point of failure. A reasonable optimization here would be for each robot to look for a signature from a different robot and refuse to sign. In the case of robot compromise (legal or illegal), the robot's key can be revoked. This may hurt the people who had their keys signed by that particular robot, but does not affect the rest. This revision also allows the scheme to survive if some of the robots go away - as long as the keeper of the master key does not go away. For me, the piece of the "get everyone using encryption" project that Brad really hit on the head is the need for absolutely zero UI. To do this well in the client, we're really going to need some amount of vendor buy-in. Without zero (or pretty darn close to zero) UI, we can poke around with simplifying key management for years without accomplishing much because of the "If I have to do anything to use it, then I won't use it" mindset. I don't really like doing the encryption in the MTA as that puts the responsibility on a machine in the ISP. This machine is likely to be a far richer prize to an attacker than a home box, as well as being far more snoopable on via legal or illegal means. > I want to bifurcate the issue and ask everyone here: > > (1) What's the best design for an "informal key exchange" scheme in > which active MITM attacks may be permitted, but privacy against > passive wiretapping (as well as trivial impersonation attacks) is > maintained? How can this be implemented with the smaller amount of > user interface, while maintaining the largest amount of compatibility > in both directions with existing e-mail privacy systems for > sophisticated users? The easiest thing to do would be a email header that contains key information. Loads of people do this already ("X-My-PGP-Key: ..." and similar). If we could standardize a format, then smart clients could use it to automatically fetch the key. I'd suggest some sort of URL, for maximum flexibility. For bandwidth and messiness reasons, I don't really like the S/MIME feature of sending the key around all the time. Using a new email header for this has the nice feature of not breaking any of the current email infrastructure - any non-capable clients will just ignore it. > (2) What's the best way to get such a system designed and deployed to > the general public? How can an organization like EFF best help > accomplish this? Whose help do we need? Microsoft (like it or not, they make one of the most widely used MUAs on the planet). AOL/Netscape. And the developers of as many mailers we can get to listen. If this only happens in the open-source world, then we're not really solving the problem. Way back when, Netscape did a cute thing to push https: it made a big deal of the security icons on the browser, and made sure that you knew you did not have an encrypted connection when you submitted a form. I'd love to see mailers scold the user this way if they tried to send an unencrypted email. I favor using OpenPGP as the underlying protocol for all of this as there is wide understanding of OpenPGP and lots of code available under various licenses, including the GPL. Using OpenPGP also allows "power users" to use the full OpenPGP trust model if they choose to without affecting the people using the simplified model. I am very interested in working on these problems with anyone else who would like to join me. David [1] This could also be OpenPGP-style signing subkeys, but for a handful of reasons (the keyservers not handling keys like that very well for starters) it may better to use other keys. -- David Shaw | dshaw(a)jabberwocky.com | WWW http://www.jabberwocky.com/ +---------------------------------------------------------------------------+ "There are two major products that come out of Berkeley: LSD and UNIX. We don't believe this to be a coincidence." - Jeremy S. Anderson

2 1