September 2001 - cypherpunks-legacy

Product Give Away - Take 5 !
by Stephanie Key 05 Sep '01

05 Sep '01

If you cannot view this message, please visit http://www.globalzon2k.com/news_vercheck1.htm G7 Productivity Systems, Inc. is sending this email to its subscribed users. You are subscribed as: cypherpunks(a)algebra.com FREE Products shipped in Full Retail Packaging Pick up to 5 of each! <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=314&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=315&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=313&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=317&size=1> <http://www.g7ps.com/scripts/shopcrt.asp?qty=1&product=316&size=1> Fortune. (149.99 value) DataScan (149.99 value) eXpressForms 2000 (129.99 value) TransForm Personal (59.99 value) VersaClips (19.99 value) ? Fortune: Relationship manager and addressbook ? DataScan: Business card and telephone directory scanning software ? ExpressForms 2000: Forms, Invitation and Greeting Card generator to publish on the Internet ? TransForm Personal: Scan and convert your paper forms into editable electronic forms in seconds. ? VersaClips: Accentuate your checks, website and documents with handcrafted background images. Click on any of the graphics above to add your FREE products! About VersaCheck 2001 VersaCheck enables businesses and individuals to create their own custom checks. All it takes is a desktop printer, blank paper and VersaCheck software! The checks look professional and are fully bankable. VersaCheck is available at most computer retail stores and online. It works with most accounting and personal finance software such as Quicken, Money, QuickBooks, Peachtree and many more. Four popular versions to choose from: VersaCheck 2001 Personal Home & Business Professional Premium <http://www.g7ps.com> VersaCheck Comes with High Quality Blank Security Check Stock Available Colors: Tan, Burgundy, Green and Blue Sample Check Please call 800-303-2620 for questions or assistance regarding this offer. Thank you very much. Best regards, Stephanie Key Customer Relationship Executive 800-303-2620 To change your communication preferences Click Here <http://www.globalzon2k.com/scripts/de.asp?e=cypherpunks%40algebra%2Ecom > or simply reply to this Email with UNSUBSCRIBE in the subject line. Copyright © Globalzon, Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.

1 0

VersaCheck Prestige & Premium Checks!
by Lisa Thornton 05 Sep '01

05 Sep '01

You are subscribed as: cypherpunks(a)algebra.com Good Afternoon! 1. New: highly attractive and secure Prestige & Premium check styles from G7 http://www.g7ps.com 2. Get your Executive Membership today and save on all your purchases of toner supplies, software and blank check paper! Click on the link below and then on the "Become a Member and Save" banner: http://www.g7ps.com 3. FREE Productivity Software in full retail packaging: ******************** a) eXpressForms "forms publisher" ($129.99 value) b) Fortune "relationship manager" ($149.99 value) c) DataScan "business card & contact list scanner" ($149.99 value) d) TransForm Suite "automatic form creation and text OCR" ($59.99 value) Pick up your FREE products at the web site specified below. Click on the following link for details and to order (or call the 800 number below) http://www.g7ps.com ********************* Please do not hesitate to call 800-303-2620 for any questions you may have. Thank you very much. Regards, Lisa Thornton Productivity Services Director G7 Productivity Systems, Inc. lisat(a)etransmail2.com 800-303-2620 To change your communication preference please click on: http://www.globalzon2k.com/scripts/mf_de.asp?e=cypherpunks@algebra.com or simply reply to this Email with UNSUBSCRIBE in the subject line.

1 0

Re: Official Anonymizing
by Faustine 05 Sep '01

05 Sep '01

Some poor simple soul behind a remailer wrote: >Here is an example of the principle put into practice, from the >anonymous web proxy service at http://proxy.magusnet.com/proxy.html: : If you are accessing this proxy from a *.mil or *.gov address : it will not work. As a taxpaying United States Citizen[TM], : Business Owner, and Desert Storm Veteran, I do not want my : tax dollars being used by agencies I pay for to gawk(1) : at WWW pages and hide your origination point at my expense. : Now, get back to work! Patronizing claptrap, you wouldn't be blocking a thing. For example, the Google Archives has dozens of listings of a NSA researcher who openly participates in technical conferences, giving his full Ft. Meade address, office phone number--and AOL e-mail address. Before you dismiss this as just something another dumb fed might do, you might find it relevant that he's done a lot of work in IDS, GII security, reliable distributed systems, and deception. Who would ever expect anything interesting from an AOL user? That's precisely the point. That ought to be enough keywords: go dig for it yourself, and if you're really lucky, you'll find PDFs of his papers and start learning a little bit about why you haven't quite got the feds as outsmarted as you think you do. ~Faustine.

1 0

Re: Official Anonymizing
by Greg Broiles 05 Sep '01

05 Sep '01

At 02:37 PM 9/5/2001 -0400, Faustine wrote: > >And, in the spirit of full disclosure, I'll mention that at C2Net we did > >sell our software to the government/intelligence agencies who wanted it - > >they paid the same prices as any other customers, signed the same sales > >contracts (we'd negotiate some on warranty terms for big purchases), and > >otherwise got what everyone else got - not more, not less. > >Your honesty is admirable--and unlike certain other cases, I don't have any >real reason to doubt what you say. But are you sure you have adequate >security and counter-economic espionage measures in place? Have you had >anyone do penetration testing lately? How much do you trust the people you >work with? Everything I've mentioned about C2Net is now several years old - I left the company in the last few months of 1998, and they've since been acquired and swallowed-up by Red Hat (RHAT), and (almost?) everyone who worked there when I was there has also left. If I weren't confident that I'm talking about history, not current events, I wouldn't be saying anything. (.. and there are some parts of the C2Net history which I'll likely never be in a position to disclose, ethically speaking, because of the nature of my relationship (general counsel) with the organization. Caveat emptor.) We did take an active interest in the security of our systems and codebase - I don't think we were perfect, with respect to physical or electronic security, but we were pretty paranoid, perhaps at some cost to the personal lives of the principals involved. But your points about insider risks are well taken - especially given that most security incidents have an inside, not outside, source. I believe that the software we published was free of intentional holes or errors, and was built as carefully as we knew how; that belief is based on my familiarity with the build environment, and my knowledge over several years of the people involved in the development process, and my impressions of their competence and integrity. Still, people's expectations and faith in other people can be misplaced - c.f. Aldrich Ames, Robert Hanssen (a personal friend of James [Puzzle Palace, Body of Secrets] Bamford, who never suspected), and Brian Regan - I don't know of any method or practice which can prevent hidden betrayal, for love or money or boredom or personal animus. And Ken Thompson's "Reflections on Trusting Trust" <http://www.acm.org/classics/sep95/> serves as a reminder of how subtle a betrayal or compromise can be, yet remain active and dangerous. A big part of our counter-economic-coercion resistance was ideological - if people really believe that they're working to protect and defend freedom and privacy, it's hard to tempt them with money, at least not just a little money. On the other hand, it's easier to tempt them with ideological arguments, which are cheaper; or for them to become so entranced with each other's political correctness that they lose sight of basic personal integrity and decency. (We didn't have trouble with that at C2Net, but it's historically been a problem inside ideologically-motivated organizations or groups.) >With a lot of >young tech companies having spent the last few years feeling fat, happy, >and oh-so-much smarter than those fusty old feds, you've got a potentially >massive disaster in the making. Pride goeth before destruction; and a haughty spirit before a fall. -- Greg Broiles gbroiles(a)well.com "We have found and closed the thing you watch us with." -- New Delhi street kids

1 0

Re: Moral Crypto
by Declan McCullagh 05 Sep '01

05 Sep '01

Your analogy is wrong. You should compare the number of meatspace publishers and their political clout to the number of anonymous remailer operators and their political clout. -Declan On Wed, Sep 05, 2001 at 01:21:03PM -0500, Fisher Mark wrote: > > Killing remailers will be a by-product of regulating the net. > > Regulating the net to this extent would be a huge undertaking. Trying to > regulate dead-tree publishers to this level would be a large undertaking, a > task not likely to be accomplished without a lot of debate in Congress -- > and there are many fewer dead-tree publishers than net publishers. > > The only way this could be done would be to attack at the large ISP level, > which then brings up First Amendment issues along with common carrier > issues. It could be done, but it would likely take a covert operation so > large that: > * It could only be funded by a government or other large body; and > * Which would likely come to light relatively quickly ("three can keep a > secret, if two are dead"). > > (Covert operation in the sense of staging many events that use the net in > the process of harming people, as in using remailers for staging > terrorist-like attacks for the express purpose of scaring the American > public into abrogating their First Amendments rights unilaterally on the > net.) > =============================================== > Mark Leighton Fisher fisherm(a)tce.com > Thomson multimedia, Inc. Indianapolis IN > The Illuminati are not dead -- > they're just pining for the fnords...

1 0

Re: speech + action
by mmotyka＠lsil.com 05 Sep '01

05 Sep '01

Tim May <tcmay(a)got.net> wrote : >On Tuesday, September 4, 2001, at 10:59 AM, mmotyka(a)lsil.com wrote: > >> Declan McCullagh wrote: >>> >>> On Fri, Aug 31, 2001 at 10:59:54AM -0700, mmotyka(a)lsil.com wrote: >>>> Sure, I mention it because despite its being non-functional and >>>> unpunishable it seemed to have been brought into the courtroom with >>>> the >>>> purpose of spicing up the case. >>> >>> Sure. If you commit unacceptable-to-the-gvt *actions* and also spend a >>> lot of time talking about how government officials should be >>> assassinated, you may reasonably expect those statements to be used >>> against you during your trial. >>> I think the speech, irrelevant as it was, was used to increase the perceived severity of the actions. Isn't this in effect being punished for speech+action? >>> But that is a far cry from your earlier government-has-this-power >>> position, from which you're now backtracking. >>> >>> -Declan >>> >> Not so much backtracking as thinking out loud. Just musing on how the >> letter of the law, its constitutionality, enforcement and even the >> reasoning behind its creation are not always lined up so well. >> >> 18 U.S.C. 23 1 contains the seeds of the speech+action idea. >> > >Please explain. You made the first assertion of this, then "backslid" as >people poked holes in your argument, now you appear to be swinging back >in the other direction merely by asserting something about "seeds." > Really little to explain. Obviously laws cover speech + action. It's just a question of where the boundaries are in their application. I don't know too much about those finer points. [CITE: 18USC371] TITLE 18--CRIMES AND CRIMINAL PROCEDURE PART I--CRIMES CHAPTER 19--CONSPIRACY Sec. 371. Conspiracy to commit offense or to defraud United States If two or more persons conspire either to commit any offense against the United States, or to defraud the United States, or any agency thereof in any manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under this title or imprisoned not more than five years, or both. <snip> Could this be applied to software development? I suppose that depends on whether the software in design is prohibited or not. Until the DMCA is altered or deleted there's already a class of SW that is illegal. It doesn't seem so far-fetched that a discussion of content piracy followed by an active coding project could be attacked. Why not a discussion of tax evasion methods followed by a development project? And don't forget that it's still possible to run afoul of the crypto export regulations. Are our visionary legislators capable of outlawing new classes of software? It's a sure bet. I'll leave it to the lawyers to argue over how specific the speech and actions need to be. Want to test it? Start a project with the stated goals of providing a neat open source project with the stated purpose of cracking and exchanging e-books and start posting code. If you were to start YAPPFSP ( yet another peer to peer file sharing project ) would you state its purpose as "to share pirated music data?" >Could you give a cite for any prosecutions, or are you just speculating >that "Happy Fun Court" will not be "amused" by free speech? > I'm sure there are plenty of conspiracy cases involving the more blatant crimes like kidnapping etc... Are there any militia cases? Like you said, try and find one. The law as written does seem to outlaw speech. The anti-militia laws are interesting in that the least popular are likely to suffer first from "creative" legislation. If an approach is successful against the unpopular then it can always be expanded to include new groups. I offer the bomz and drug speech legislation as further attempts along the same lines. Successful, no, not yet, but they'll keep trying. If they are eventually successful it will cost somebody a bundle to get it overturned. That's a market problem : it's cheaper to make bad law than it is to unmake it. As for the fictional Happy Fun Court's inquisitorial wet dreams, it can go spoliate its head in a bucket. >Comment: It seems to me we are seeing way too many people hitting the >panic button, speculating about some of us getting shot by agents of >happy fun courts, claiming that merely using secrecy methods is >spoliation, arguing that speech is being criminalized, and that, in >essence, we'd all better just slink away from these free speech and >crypto thoughtcrimes. > Speculating yes, panic button, no. It can be instructive to pursue an idea to an extreme. >Fuck that. Don't let the wuss ninnies scare you off. > >--TIm May > Ah, the dreaded wuss-ninnies. I'm not losing any sleep over the Happy Fun Court or its cackling brigade of wuss-ninnies. I'm more concerned that all of the cat5 wires I pulled through the smurf tubes this past weekend are not damaged so I don't have to crawl around my fucking attic anymore. If there's anything I dislike more than wuss-ninnies it's blown-in fiberglass. Mike Question : is steganography code export restricted or is it not even described under the current set of rules?

1 0

ADV: RE: High Quality Web hosting $6.95 per month - NO GIMMICKS!
by billycartin＠gopbi.com 05 Sep '01

05 Sep '01

1 0

Re: Official Anonymizing
by Faustine 05 Sep '01

05 Sep '01

Greg wrote At 04:33 PM 9/4/2001 -0700, John Young wrote: >Look, I'll accept that we will all succumb to the power of the market, >so limit my proposal for full disclosure to those over 30. After that >age one should know there is no way to be truly open-minded. >And, in the spirit of full disclosure, I'll mention that at C2Net we did >sell our software to the government/intelligence agencies who wanted it - >they paid the same prices as any other customers, signed the same sales >contracts (we'd negotiate some on warranty terms for big purchases), and >otherwise got what everyone else got - not more, not less. Your honesty is admirable--and unlike certain other cases, I don't have any real reason to doubt what you say. But are you sure you have adequate security and counter-economic espionage measures in place? Have you had anyone do penetration testing lately? How much do you trust the people you work with? Wish I had a nickel for every time some young (or not-so-young)turk at a security conference or elsewhere started blabbing about things they shouldn't have out of nothing more than a desire to seem big and impress me. Feds and hackers alike, same old song and dance. I never even try to elicit information, either: I don't know, maybe it's some kind of sexist thing to assume a sweet-faced polite young woman could ever be a security threat. The sick thing is, if I were really evil I could have made a lot more than a nickel... Depressing. Wake up and shut up, dumbasses. Back to the insider problem: It's not exclusively a moral issue--whether you think you have more to fear from Uncle Sam, China, or the competitor down the street, everyone can agree that employees who sell out your technology to those out to compromise it are bad news. And frankly, the very people who wouldn't deal with China in a million years might be the ones most willing to listen to agents peddling the old "in the interests of national security" line. And whereas government agencies have always had a strong "culture of paranoia" that at least gets the issues on the table, private companies are at a disadvantage because they never even saw it coming. With a lot of young tech companies having spent the last few years feeling fat, happy, and oh-so-much smarter than those fusty old feds, you've got a potentially massive disaster in the making. Oh well, here's hoping you never get stung by the insider problem personally. ~Faustine.

1 0

Re: Official Anonymizing
by A. Melon 05 Sep '01

05 Sep '01

John Young takes a courageous stand: > I propose that all anonymizers adopt a code of practice that > any sale to officials of anonymizers or their use be disclosed > to the public (I suggested this to ZKS early on when first > meetings with the feds to explain the technology were being > sometimes disclosed). That seems to be a reasonable response > to officially-secret prowling and investigating cyberspace. Absolutely appropriate, given cypherpunk goals. It may be difficult to apply in every case but the intention is laudable. Here is an example of the principle put into practice, from the anonymous web proxy service at http://proxy.magusnet.com/proxy.html: : If you are accessing this proxy from a *.mil or *.gov address : it will not work. As a taxpaying United States Citizen[TM], : Business Owner, and Desert Storm Veteran, I do not want my : tax dollars being used by agencies I pay for to gawk(1) : at WWW pages and hide your origination point at my expense. : Now, get back to work!

5 4

Re: Moral Crypto
by Fisher Mark 05 Sep '01

05 Sep '01

> Killing remailers will be a by-product of regulating the net. Regulating the net to this extent would be a huge undertaking. Trying to regulate dead-tree publishers to this level would be a large undertaking, a task not likely to be accomplished without a lot of debate in Congress -- and there are many fewer dead-tree publishers than net publishers. The only way this could be done would be to attack at the large ISP level, which then brings up First Amendment issues along with common carrier issues. It could be done, but it would likely take a covert operation so large that: * It could only be funded by a government or other large body; and * Which would likely come to light relatively quickly ("three can keep a secret, if two are dead"). (Covert operation in the sense of staging many events that use the net in the process of harming people, as in using remailers for staging terrorist-like attacks for the express purpose of scaring the American public into abrogating their First Amendments rights unilaterally on the net.) =============================================== Mark Leighton Fisher fisherm(a)tce.com Thomson multimedia, Inc. Indianapolis IN The Illuminati are not dead -- they're just pining for the fnords...

1 0