March 2001 - cypherpunks-legacy

Re: semi-anon test from a throwaway account part deux
by Anonymous 29 Mar '01

29 Mar '01

>www.safeweb.com >Free. >Encrypts all data coming from website, but does not >obscure URLs in requests. >Pretty fast. Lots of configurable >options for cookies, etc. Too bad it doesn't work at all: Your browser sent a request that this server could not understand. Invalid URI in request GET /?placetogo=www.yahoo.com HTTP/1.0 Apache/1.3.12 Server at www.safeweb.com Port 443

1 0

New SalvageSale.com Offers (03/29/01)
by customercare＠salvagesale.com 29 Mar '01

29 Mar '01

1 0

Re: Wholsalers America-Its Time To Make Some Real Money (fwd)
by Jim Choate 29 Mar '01

29 Mar '01

____________________________________________________________________ Beware gentle knight, there is no greater monster than reason. Miguel de Cervantes The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: Thu, 29 Mar 2001 17:34:57 -0500 From: Marcus Watts <mdw(a)umich.edu> To: coderpunks(a)toad.com Subject: Re: Wholsalers America-Its Time To Make Some Real Money Various have written: > mkb: > > > seems feasible to me to keep out a lot of the spam while still > > > allowing anonymous posters to contribute. > > spiff: > > see here: > > > > http://www.toad.com/gnu/verio-censorship.html > > oi. > > i was thinking of it more from a technical standpoint than a political > one. a few simple filters would stop a lot of the spam without much > impact on anonymous posters. for example, don't allow messages that > don't list coderpunks(a)toad.com on the To or Cc headers. "coderpunks(a)toad.com" would match To: fields of 26 of the last 60 spam messages. No hits in cc: - guess it's not so popular in spam. There's also "resent-to" and "resent-cc", and of course bcc (and how do you spot that?...) Of course, anything to "Undisclosed.recipients(a)toad.com" is pretty glaring. To be really effective, a spam filter has to look for less obvious "spam signatures" that aren't so easily spoofed. For instance, there was once a spam package that sent out date fields that looked like: Date: 1/6/99 9:17:27 AM Pacific Daylight Time (and since when has PDT applied in january?) Authors of real mail programs have to worry about y2k considerations, international users, and other considerations that never bother spammers. I've got "a few simple filters" on all mail I receive (actually, more than a few these days), including that from coderpunks. Until these last 2 flurries of spam, I thought I was doing pretty good. I did catch a few, but it was like 10%--pathetic. Now I understand (from the URL above) why my filters lost it big-time - apparently I'm filtering the spam that's already been through "a few simple filters" upstream of me. It looks like I'll be doing a lot more content based spam filtering. I've already got 3 of them going... I don't know what toad.com says [if anything] when it bounces spam, but I bounce spam with a bible quote. Last thing I want to tell the spammer is how to get around the filter. I hope instead they'll pull my address from their list as "undeliverable". Unfortunately, I also bounce the occasional legitimate mail with a bible quote - them's the breaks. I hate to think this might all be due to some silly dispute with an ISP -- things ought not to get to that point. One random thought: I wonder if we've created any of this problem ourselves? For instance, if any of us has an automated script that sends a spam complaint off to the "responsible parties", it's possible those scripts have decided it's toad.com's fault the spam got sent, and fired an inflamatory message off to verio... I know I don't do this (I no longer get mad, I get even. My filters protect 20,000 mailboxes...), but perhaps others of us? > i'm sorry to be filling up the list with anti-spam talk rather than > crypto talk. i did try to contact the moderator directly. Me to (well, except I didn't try to contact the moderator--which is um, don't we have more than one?, um...) That's the problem - both when the spam overwhelms legitimate content, and when talk turns to dealing with the problem. I had proposed the "few simple filters" approach on the list a long long while back--wish it had been done sooner so the spammers wouldn't have had quite so many CD-roms out with coderpunks@ on it. The latest round of bounces had me seriously wondering about just was happening (had space aliens swapped the brains of Spamford and Gilmore?) A more "interesting" way to do the "simple filter" approach (and one that might actually have some real relevance to the purpose of this list!) might be something that actually uses cryptography. For instance, one solution might be to have a web server that supplies a cryptographic "token", good for one mailing through the mailing list. Simply cut & paste somewhere in the body of the message, and the mail list software could remove the token before delivery. It can even be anonymous (web server hands it out to anyone) - the idea here isn't actually to secure or authenticate the content, but simply to put an obstacle that prevents automated scripts, regular mmf spammers and the usual lot of scum from actually posting anything to the list. If mail missing the token is delivered to the moderator(s) even mail missing the magic token could be forwarded if it were relevant, although I don't think the moderators would want to encourage this as a matter of habit. -Marcus

1 0

Digital Signatures based on secure hashes (fwd)
by Jim Choate 29 Mar '01

29 Mar '01

FYI ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ---------- Forwarded message ---------- Date: Thu, 29 Mar 2001 13:58:32 -0800 (PST) From: Bram Cohen <bram(a)gawth.com> To: People who supposedly write code <coderpunks(a)toad.com> Subject: Digital Signatures based on secure hashes I put together some code for doing digital signatures based on secure hashes. Surprisingly, I was able to make it reasonably practical. You can find well-documented reference code with test cases at - http://gawth.com/bram/CheapSignaturesBeta.py I would much appreciate it if anyone would analyze the code - I'm pretty sure it's secure, since it's use of hashes falls within my area of expertise, but don't really feel confident until other people have looked at it as well. I suspect at least some of the ideas are original, although I haven't looked at the literature much - I'm particularly proud of the 165 choose 82 trick. You can find code for running all it's tests at - http://gawth.com/bram/testtest.py -Bram Cohen Soko! puzzle game - http://ch.havenco.com:4201/

1 0

The Register - FPGA Computing a 1000x improvement?
by Jim Choate 29 Mar '01

29 Mar '01

http://www.theregister.co.uk/content/2/17979.html -- ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

did cryptome.org lose it's name?
by Eric Murray 29 Mar '01

29 Mar '01

It looks like cryptome.org's lost it's name: % ericm(pts/1)# whois crytpome.org [whois.internic.net] Whois Server Version 1.3 No match for "CRYTPOME.ORG". >>> Last update of whois database: Thu, 29 Mar 2001 08:24:30 EST <<< The Registry database contains ONLY .COM, .NET, .ORG, .EDU domains and Registrars. % ericm (pts/1)# dig crytpome.org any ; <<>> DiG 8.3 <<>> crytpome.org any ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUERY SECTION: ;; crytpome.org, type = ANY, class = IN ;; AUTHORITY SECTION: org. 2h55m7s IN SOA A.GTLD-SERVERS.NET. hostmaster.nsiregistry.NET. ( 2001032801 ; serial 30M ; refresh 15M ; retry 1W ; expiry 1D ) ; minimum ;; Total query time: 5203 msec ;; FROM: slack to SERVER: default -- 127.0.0.1 ;; WHEN: Thu Mar 29 12:56:28 2001 ;; MSG SIZE sent: 30 rcvd: 107 Coincidence or conspiracy? http://216.167.120.50 still works though. Eric

2 1

The Register - War Driving?
by Jim Choate 29 Mar '01

29 Mar '01

http://www.theregister.co.uk/content/8/17976.html -- ____________________________________________________________________ If the law is based on precedence, why is the Constitution not the final precedence since it's the primary authority? The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: semi-anon test from a throwaway account part deux
by Trei, Peter 29 Mar '01

29 Mar '01

> From: Jim Choate[SMTP:ravage@EINSTEIN.ssz.com] > > On Wed, 28 Mar 2001, Trei, Peter wrote: > > > Yes Jim, I am one to talk. In my (small) town, there are no video > cameras in > > the PO. I've looked for them, carefully and repeatedly. (The notion that > my > > Dude, they feed full video through a fiber cable that fits in the center > shaft of the clock hands. They put them in fire detectors (and they still > detect to boot), they put them in the holes of the ceiling tile. You could > look all day long and not see it. > As usual, Jim relies on selective quotation when it suits his purpose. In big city POs, the cameras are out in the open. I stand by my position (stated in the parts of my letter he deleted) that the absence of easily visible cameras in my small town PO is not evidence of hidden cameras, but evidence that there are none. Of course, he can't give an actual citation for a policy of concealed cameras in POs. He'd rather contend that 800,000 USPS civiilian employees, most of whom have no security clearance, all have maintained the existance of the hidden cameras in 38,000 POs as a perfect secret for years, while running 200 billion pieces of mail a year past cash-sniffing dogs. Jim needs to learn a few things from William of Occam. Peter Trei

1 0

Re: Virginia law bans anonymous remailers
by Anonymous 29 Mar '01

29 Mar '01

On Wed, 28 Mar 2001, Declan McCullagh wrote: > > See also: > http://www.politechbot.com/p-01862.html So, I don't see how this bans anonymous remailers. Unlike the perl script you wrote, anonymous remailers don't provide *false* information about the source of the message; they just provide incomplete information. This message *did* come from noisebox.cypherpunks.to, just like the headers say. -MW-

1 0

Re: did cryptome.org lose it's name?
by Eric Murray 29 Mar '01

29 Mar '01

Never mind, I cut-and-pasted John's typo. Cryptome.org is fine. Crytpome.org will shortly be a link to a porn site to capitalize on the flood of hits from careless users. Ericm

1 0