September 2002 - cypherpunks-legacy

RE: cybersecurity proclamations vs. specific-application security
by Trei, Peter 20 Sep '02

20 Sep '02

> Major Variola (ret)[SMTP:mv@cdc.gov] wrote: > > > Instead of protecting the whole net, those responsible for > 'critical' services should be held responsible for their app. > > Use an air-gap, your refinery/dam/etc control doesn't > need to be online. > > If you must use networking for critical stuff (air traffic, medical > insurance > transactions) then use VPNs. And good policies. > Use several independent upstream providers if > reliability is important too, as it usually is. Tracert is your friend. > > Use caching DNS proxies if you worry about DNS-root attacks. > > Hold the managers of the 'critical' domains responsible. > Let them hire security folks who'll do gedanken et al. attacks > and learn to beef up their stuff. > > Its a *lot* easier to focus on specific 'critical' domains and > strengthen them than to whine and proclaim from D.C. about > the 'infrastructure' > > Perhaps fed tax breaks on fees paid to security folks > would help. And tax breaks on equiptment security upgrades. > Create/enforce tort laws so that when folks screw up security, > they pay. > > <\rant> > > At 07:33 AM 9/20/02 -0700, Declan McCullagh wrote: > >Previous Politech message: > > > >"Defense hawks bash White House report, want new laws, regulations" > >http://www.politechbot.com/p-03999.html > > > >James Lewis was one of the two CSISers I quoted in that article as > wanting more laws. [...] OR Make corporations financially liable if they fail to provide a service due to a cyberattack. Their insurance firms will then start to require standards in a much more diverse and flexible way than legislation would. This is similar to how bank vault and safe standards were improved during the last century. Peter Trei

1 0

Bit Commitment Blues
by Eugen Leitl 20 Sep '02

20 Sep '02

[via SomeMailingList] http://home.datawest.net/staym/commit.html Bit Commitment Blues by Mike Stay You think I got zero knowledge, But I know you done me wrong. Just commit to me baby, So's I can sing a happier song! One bit of commitment, That's all I really need, So send me your hashed answer And the random seed. I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues. I ain't oblivious, darlin', And honey, I ain't blind. Don't need sublim'nal channels To read your cheatin' mind. I'll share a secret with you: I know you hand out a public key. But why's it to the apartment That you're sharin' with me? I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues. You say you love me, baby, But you flirt with other guys. You say you want me, honey, But I see you wink your eye. You say you need me, Alice, Now forgive me if I sob; You know my name is Charlie, So quit hangin' out with Bob! I got the bit commitment, bit commitment blues. I got the (thump thump hmmm...) bit commitment blues.

1 0

Re: software-defined radio killer app
by Ken Brown 20 Sep '02

20 Sep '02

The biggest police station in western Europe is being built less than half a mile from where I live. Your phone will keep on ringing and ringing... "Major Variola (ret)" wrote: > > In some parts of rural america, folks signal the presence of cops by > flashing their headlights > when driving. > > Occurs to me that would be a cool function for SDR: press code for or > say "cop". For N seconds, > phone periodically sends "cop" message picked up by other phones, > ignored by base station [1]. Phone also listens for these local > broadcasts. Upon hearing a suprathreshold number of "cop" messages the > phone alerts its owner. > > Better than a radar detector for emissionless, but visible, cops. Over > the hill coverage. Issues of > spoofing, trust, consensus familiar to readers here. > > [1] (different band entirely? UWB? B-tooth? FRS? )

1 0

CALL FOR HELP...
by MR. GEORGE WILLIAMS. 20 Sep '02

20 Sep '02

Dear C.E.O, It is my humble pleasure to write this letter irrespective of th fact that you do not know me. However, I came to know of you in my private search for a reliable and trustworthy person that can handle a confidential transaction of this nature in respect to our investment plans in real estate. Though I know that a transaction of this magnitude will make any one apprehensive and worried, but I am assuring you that all will be well at the end of the day. Let me start by first, introducing myself properly to you. I am MR. GEORGE WILLIAMS., a Branch Manager at one of the Zenith Commercial Bank Nigeria Plc, Lagos. A foreigner, Late Nicholas Owen, a Civil Engineer/Contractor with the federal Government of Nigeria, until his death three years ago in a ghastly air crash, banked with us here at the Zenith Commercial Bank PLC, Lagos. He had a closing balance of USD$46.7M (Fourty Six Million,Seven Hundred Thousand United States Dollars) which the bank now unquestionably expects to be claimed by any of his available foreign next of kin. Or, alternatively be donated to a discredited trust fund for arms and ammunition at a military war college here in Nigeria. Fervent valuable efforts made by the Zenith Bank to get in touch with any of late Nicholas Owens next of kin (he had no known wife and children) has been unsuccessful. The management under the influence of our chairman and board of directors, are making arrangement for the fund to be declared "UNCLAIMABLE " and then be subsequently donated to the trust fund for Arms and Ammunition which will further enhance the course of war in Africa and the world in general. In order to avert this negative development. Myself and some of my trusted colleagues in the bank, now seek for your permission to have you stand as late Nicholas Owens next of kin. So that the fund (USD$46.7M), would be subsequently transferred and paid into your bank account as the beneficiary next of kin through our overseas corresponding bank. All documents and proves to enable you get this fund have been carefully worked out and we are assuring you a 100% risk free involvement. Your share would be 30% of the total amount. While the rest would be for me and my colleagues for purchase of properties in your country through you/your Company. If this proposal is OK by you, then kindly get to me immediately via my e-mail wilge002(a)accountant.r.com furnishing me with your most confidential telephone, fax and e-mail, so I can forward to you the relevant details of this transaction. Thank you in advance for your anticipated cooperation. Best Regards. MR. GEORGE WILLIAMS. Branch Manager, Zenith Comm. Bank Plc.

1 0

Deposit not returned by TransAmerica? rbtj
by juu3.d_From_John Deposit not returned by TransAmerica?_To_cypherpunks＠minder.net 20 Sep '02

20 Sep '02

1 0

Fwd: Re: Making money the RIGHT way! 30191
by brean98＠hotmail.com 20 Sep '02

20 Sep '02

Do you know...? That it is EASY to make from $7,000-$10,000 per month as a Loan Officer? If you thought that in order to be a Mortgate Loan Officer, you had to Graduate from College, be Certified, Licensed or Bonded. . . Think Again! -> You can Start your own Home-Based Mortgage Loan Business with our Extensive Step-by-Step Training Program. -> Learn Our Exclusive - Response PROVEN - Method for Putting $7,000 - $10,000 in YOUR Bank Account every Month. -> Make Nation-Wide Mortgage Loans over the Internet in the Comfort of your Own Home. -> Sell Loans for HUGE Profits with NO out of Pocket Expense -> Take advantage NOW of the Lowest Interest Rates in OVER 50 years! Click Below NOW for all the details! "http://61.129.68.54/loanoriginators/index.php?Aff=2" OR you can also Cut & Paste the above link in your browser window. This message is coming to you as a result of an Opt-in Relationship our Clients have had with you. If you simply wish to be Removed from all future Messages, then CLICK BELOW "http://61.129.68.54/loanoriginators/remove/remove.html"

1 0

BRAND NEW CREDIT FILE!!
by MARIA 20 Sep '02

20 Sep '02

Dear Friend, We have got some great news for you... Finally, you can be approved for a brand new luxury car or dream house !!! With a BRAND NEW CREDIT FILE !! This is not credit repair. This is what the Government & the major Credit Bureaus do not want you to know !!! We will show you how to establish a brand new credit file that has absolutely no connection to your past credit history. We will also show you how to keep your two credit files from merging with one another. And the best part is that Everyone Qualifies!!! Bankruptcy, Foreclosure, Car repo, it does not matter. Your existing credit file will be invisible to your future lenders. Many honest people have suffered financial set backs due to sudden illness, job loss, divorce & unforseen legal problems. These financial set backs often result in the loss of a good credit rating & even bankruptcy. This makes it next to impossible to start over & qualify for major necessary purchases such as a car or home. Why wait the 7 to 10 years for your existing credit file to clean itself up. This process of achieving AAA credit, with your new credit file, takes less than 30 days & not only is this 100% LEGAL, it is your RIGHT !!! Everyone makes mistakes. Perhaps you had a car repo, a foreclosure, gone through a divorce or got stuck with thousands of dollars in hospital bills. It is no longer necessary to be punished for situations that were out of your control. You do not have to be penalized for this. This is your second chance. Not only does this new credit file program work in the U.S., Canada & the United Kingdom but in over 17 countries as well... Discover the loophole in the credit system !!! Get that new car or home now... For more FREE info, click here... http://beam.to/creditfile Yours truly, MARIA MORA Hey- I'm *not* spamming you. You are in my address book because we were introduced via Target opt mail list. However, if you wish to discontinue, please click on the email link below and in the subject area type in remove and you'll be instantly removed from my address book. maria66(a)wowmail.com

1 0

RE: Cryptogram: Palladium Only for DRM
by AARG! Anonymous 20 Sep '02

20 Sep '02

Lucky Green wrote: > AARG! Wrote: > > In addition, I have argued that trusted computing in general > > will work very well with open source software. It may even > > be possible to allow the user to build the executable himself > > using a standard compilation environment. > > What AARG! is failing to mention is that Microsoft holds that Palladium, > and in particular Trusted Operating Root ("nub") implementations, are > subject to Microsoft's DRM-OS patent. Absent a patent license from > Microsoft, any individual developer, open source software development > effort, and indeed any potential competitor of Microsoft that wishes to > create a Palladium-like TOR would do so in violation of Microsoft's > patent. U.S. Patent law takes a dim view of such illegal infringers: > willful infringers, in particular infringers that generate a profit from > their creation of a non-Microsoft version of a TOR face the risk of a > court ordering such infringers to pay treble damages. That's too bad. Trusted computing is a very interesting technology with many beneficial uses. It is a shame that Microsoft has a patent on this and will be enforcing it, which will reduce the number of competing implementations. Of course, those like Lucky who believe that trusted computing technology is evil incarnate are presumably rejoicing at this news. Microsoft's patent will limit the application of this technology. And the really crazy people are the ones who say that Palladium is evil, but Microsoft is being unfair in not licensing their patent widely! > As of this moment, Microsoft has not provided the open source community > with a world-wide, royalty-free, irrevocable patent license to the > totality of Microsoft's patents utilized in Palladium's TOR. Since open > source efforts therefore remain legally prohibited from creating > non-Microsoft TORs, AARG!'s lauding of synergies between Palladium and > open source software development appears premature. Well, I was actually referring to open source applications, not the OS. Palladium-aware apps that are available in source form can be easily verified to make sure that they aren't doing anything illicit. Since the behavior of the application is relatively opaque while it is protected by Palladium technology, the availability of source serves as an appropriate balance. But it does appear that Microsoft plans to make the source to the TOR available in some form for review, so apparently they too see the synergy between open (or at least published) source and trusted computing. > > [1] A message from Microsoft's Peter Biddle on 5 Aug 2002; > > unfortunately the cryptography archive is missing this day's > > messages. "The memory isn't encrypted, nor are the apps nor > > the TOR when they are on the hard drive. Encrypting the apps > > wouldn't make them more secure, so they aren't encrypted." > > In the interest of clarity, it probably should be mentioned that any > claims Microsoft may make stating that Microsoft will not encrypt their > software or software components when used with Palladium of course only > applies to Microsoft and not to the countless other software vendors > creating applications for the Windows platform. UNLESS Microsoft means that the architecture is such that it does not support encrypting applications! The wording of the statement above seems stronger than just "we don't plan on encrypting our apps at this time". There are a couple of reasons to believe that this might be true. First, it is understood that Palladium hashes the secure portions of the applications that run. This hash is used to decrypt data and for reporting to remote servers what software is running. It seems likely that the hash is computed when the program is loaded. So the probable API is something like "load this file into secure memory, hash it and begin executing it." With that architecture, it would not work to do as some have proposed: the program loads data into secure memory, decrypts it and jumps to it. The hash would change depending on the data and the program would no longer be running what it was supposed to. This would actually undercut the Palladium security guarantees; the program would no longer be running code with a known hash. Second, the Microsoft Palladium white paper at http://www.microsoft.com/presspass/features/2002/jul02/0724palladiumwp.asp describes the secure memory as "trusted execution space". This suggests that this memory is designed for execution, not for holding data. The wording hints at an architectural separation between code and data, when in the trusted mode. > Lastly, since I have seen this error in a number of articles, it seems > worth mentioning that Microsoft stated explicitly that increasing the > security of DRM schemes protecting digital entertainment content, but > not executable code, formed the impetus to the Palladium effort. Further reason to believe that Palladium's architecture may not support the encryption of executable code.

2 1

企业增效之路必备宣传手段
by ad＠ser.com 19 Sep '02

19 Sep '02

1 0

Time:12:07:23 PM
by calvin＠notrix.ch 19 Sep '02

19 Sep '02

1 0

FREE Money for College!
by Sweepsgame.com 19 Sep '02

19 Sep '02

Dear Member, Why have more than a million families already joined Upromise? Answer: FREE MONEY FOR COLLEGE. As education costs continue to rise, families need to save more for college than ever before. Now there's a revolutionary new way to save. It's called Upromise. When you join Upromise for free , America's leading companies such as Exxon, Mobil, Toys"R"Us, AT&T, McDonald's, General Motors, Border's Books & MusicR and many others will contribute a portion of what you spend with them into a college savings account for someone you love. ______________________________________________________________ TO JOIN UPROMISE FOR FREE click http://www.ppmtrac.com/tk/128/cypherpunks@minder.net <a href="http://www.ppmtrac.com/tk/128/cypherpunks@minder.net"> AOL Users Click Here</a> ______________________________________________________________ SAVINGS EXAMPLES *Here are just a few examples of how much Upromise could help you save (over 15 years): Spend about $600/mo. on credit cards -- save $2,000 for college Buy three new cars -- save $800 for college Average $50 a month dinig out -- save $1,600 for college Spend roughly $25/mo. on long distance calls -- save $325 for college Shop online (average of $50/mo.) -- save $800 for college Membership is free. No catch. No member card. No fees. No hassles. And these are just five out of hundreds of ways you can save for college with Upromise. Start adding to your college savings right now. It only takes minutes to join for free, and the college savings keep coming. Day after day. Year after year. I look forward to welcoming you to Upromise. Best regards, Michael Bronner Founder TO JOIN UPROMISE FOR FREE click http://www.ppmtrac.com/tk/128/cypherpunks@minder.net <a href="http://www.ppmtrac.com/tk/128/cypherpunks@minder.net"> AOL Users Click Here</a> *Specific terms and conditions apply for each company's contributions. Potential savings based on 15 years of spending with Upromise contributing companies, with contributions invested and yielding an 8% annual return. This illustration does not reflect costs and fees associated with investments, which are subject to risk of loss. Actual results may vary. <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> * To remove yourself from this mailing list, point your browser to: http://i.mb00.net/remove?Sweepsgame:* * Enter your email address (cypherpunks(a)minder.net) in the field provided and click "Unsubscribe". The mailing list ID is "Sweepsgame:*". OR... * Forward a copy of this message to Sweepsgame(a)reply.mb00.net with the word remove in the subject line. <mailto:Sweepsgame@reply.mb00.net?subject=remove> This message was sent to address cypherpunks(a)minder.net X-PMG-Recipient: cypherpunks(a)minder.net <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> pmguid:1rp.34my.18wkw

1 0

VIRUS ALERT! - Undeliverable mail--"language"
by virus_alert＠nucleus.com 19 Sep '02

19 Sep '02

THE FOLLOWING IS AN AUTOMATED SECURITY ALERT FROM NUCLEUS INC. A message or attachment that was sent to you was tested prior to delivery and found to contain a virus. As a result, it was NOT delivered to you. A message sent to you by e.taylor(a)nucleus.com The suspicious attachment has been removed from the original message. Scan report: File 'href.pif' has a forbidden name Specific details regarding a virus can be found at the following links: http://www.f-secure.com/v-descs/ http://www.symantec.com/avcenter/vinfodb.html http://www.avp.ch/avpve/ http://csrc.ncsl.nist.gov/virus/ NOTE: This message is being sent from an automated, unattended account. Please read the information links supplied in this email to find out more about the particular virus you have received. If you have further questions, please email support(a)nucleus.com. Nucleus, Inc. http://www.nucleus.com/

1 0

[dgc.chat] First public release of NeuDist Distributed Transaction Clearing Framework
by R. A. Hettinga 18 Sep '02

18 Sep '02

--- begin forwarded text

1 0

Re: software-defined radio killer app
by Meyer Wolfsheim 18 Sep '02

18 Sep '02

On Wed, 18 Sep 2002, Major Variola (ret) wrote: > In some parts of rural america, folks signal the presence of cops by > flashing their headlights > when driving. > > Occurs to me that would be a cool function for SDR: press code for or > say "cop". For N seconds, > phone periodically sends "cop" message picked up by other phones, > ignored by base station [1]. Phone also listens for these local > broadcasts. Upon hearing a suprathreshold number of "cop" messages the > phone alerts its owner. > > Better than a radar detector for emissionless, but visible, cops. Over > the hill coverage. Issues of > spoofing, trust, consensus familiar to readers here. > > [1] (different band entirely? UWB? B-tooth? FRS? ) Nice idea, but it won't ever achieve a critical mass of adoptees. Oinking one's headlights to signify the presense of a cop in waiting is a well established convention unlikely to be replaced by complicated technology. People who want to play with gizmos to avoid becoming revenue sources will buy radar detectors (unless they live in places like VA, where it is illegal to possess radar detection devices.) -MW-

1 0

Re: software-defined radio killer app
by Major Variola (ret) 18 Sep '02

18 Sep '02

At 01:23 PM 9/18/02 -0700, Morlock Elloi wrote: >> Better than a radar detector for emissionless, but visible, cops. Over >> the hill coverage. Issues of > >This will be banned under WIPO and copyright laws Yep. Won't anyone think of the chiiiildren? >I think that some radar detectors have this built-in. Inter-("consumer")-node automatic communication of antisocial information over pirate protocols? I don't think so. Yet :-) I'm suggesting that end-user-configurable RF comp/comm devices are a quantum step in the development of "consumer" electronics in the us-vs.-pigs arms race. Or could be. Look dude, I'm just porting/downshifting the Rural Optical Signalling Protocol to a blog-like RF mesh network with a better horizon. You can ignore those noise bursts if you like :-) The main problem is >localisation - each district seem to be using different frequences. Could it be >that They are aware of dangers of the monoculture ? Frequencies are just bit patterns to a digitally controlled oscillator. DCOs are agile, dude. Got spectrum?

1 0

Re: ylb
by svxNatasha 18 Sep '02

18 Sep '02

1 0

Re: Cryptogram: Palladium Only for DRM
by Nomen Nescio 18 Sep '02

18 Sep '02

Peter Biddle writes: > Pd is designed to fail well - failures in SW design shouldn't result in > compromised secrets, and compromised secrets shouldn't result in a BORE > attack. Could you say something about the sense in which Palladium achieves BORE ("break once run everywhere") resistance? It seems that although Palladium is supposed to be able to provide content security (among other things), a broken Palladium implementation would allow extracting the content from the "virtual vault" where it is kept sealed. In that case the now-decrypted content can indeed run everywhere. This seems to present an inconsistency between the claimed strength of the system and the description of its security behavior. This discrepancy may be why Palladium critics like Ross Anderson charge that Microsoft intends to implement "document revocation lists" which would let Palladium systems seek out and destroy illicitly shared documents and even programs. Some have claimed that Microsoft is talking out of both sides of its mouth, promising the content industry that it will be protected against BORE attacks, while assuring the security/privacy community that the system is limited in its capabilities. If you could clear up this discrepancy that would be helpful. Thanks... --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

1/2 Price Sale...........
by 1/2 Price Sale 18 Sep '02

18 Sep '02

1 0

Felicidades!!!!
by Sandra Delgado 18 Sep '02

18 Sep '02

1 0

Re: software-defined radio killer app
by Morlock Elloi 18 Sep '02

18 Sep '02

> Better than a radar detector for emissionless, but visible, cops. Over > the hill coverage. Issues of This will be banned under WIPO and copyright laws - you may enjoy cop's presence for yourself, but transmitting it is same as broadcasting a live show without permission - after all, the all information cops emit is "present or not", so you, in essence, steal 100% of their IP. Due to a number of various radio equipment that armed people use, and characteristic signatures, it's often more than enough to listen on several frequences and match the spectral fingerprint to detect their presence (car radio, personal radio, etc.) I think that some radar detectors have this built-in. The main problem is localisation - each district seem to be using different frequences. Could it be that They are aware of dangers of the monoculture ? ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: Yahoo! Finance - Get real-time stock quotes http://finance.yahoo.com

1 0

Attn: Keep Your Computer Running FAST! KNMQTCRRM
by bjoy77＠hotmail.com 18 Sep '02

18 Sep '02

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Take Control of Your Computer With This Top-of-the-Line Software! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Symantec SystemWorks 2002 -=Professional Software Suite=- This Special Package Includes Six - Yes 6! - Feature-Packed Utilities ALL for 1 Special LOW Price of Only $29.99! This Software Will: - Protect your computer from unwanted and hazardous viruses - Help secure your private & valuable information - Allow you to transfer files and send e-mails safely - Backup your ALL your data quick and easily - Improve your PC's performance w/superior integral diagnostics! - ***** You'll NEVER have to take your PC to the repair shop AGAIN! ***** That's SIX, yes, -6- Feature-Packed Utilities @ 1 Great Price!!! A $300+ Combined Retail Value YOURS Only $29.99! (Limited Time Offer) < Price Includes FREE Shipping! > Why SO Cheap you ask? You are buying ONLINE WHOLESALE, Direct from the Warehouse TO YOU! ~~~ AND ~~~ FOR A LIMITED TIME BUY 2 OF ANY SOFTWARE & GET 1 FREE!!!! Don't fall prey to destructive viruses or programs! Protect your computer and your valuable information and... ...CLICK HERE TO ORDER NOW! -> http://61.151.247.39/erik/ OR cut & paste the above link ^^^^^^^^^^^^^^^^ in your browser's URL bar. FOR MORE QUESTIONS, OR TO ORDER CALL US TOLL-FREE ANYTIME! 1 - 8 0 0 - 8 6 1 - 1 4 8 1 We are strongly against sending unsolicited emails to those who do not wish to receive our special mailings. You have opted-in to one or more of our affiliate sites requesting to be notified of any special offers we may run from time to time. We also have attained the services of an independent 3rd party to overlook list management and removal services. The list CODE in which you are registered is marked at the bottom of this email. If you do not wish to receive further mailings, Please click here -> http://61.151.247.39/erik/remove.asp to be removed from the list. Please accept our apologies if you have been sent this email in error. We honor all removal requests. IAES (International Association of Email Security) Approved List. Serial # 9e45tYu2-ssI3USA

1 0

but _is_ the pentium securely virtualizable? (Re: Cryptogram: Palladium Only for DRM)
by Adam Back 18 Sep '02

18 Sep '02

On Mon, Sep 16, 2002 at 11:01:06PM -0400, Perry E. Metzger wrote: > [...] in a correctly operating OS, MMUs+file permissions do more or > less stop processes from seeing each others data if the OS functions > correctly. The OS can stop user processes inspecting each others address space. Therefor a remote exploit in one piece of application software should not result in a compromise of another piece of software. (So an IE bug should not allow the banking application to be broken.) (Note also that in practice with must current OSes converting gaining root once given access to local processes is not that well guaranteed). However the OS itself is a complex piece of software, and frequently remote exploits are found in it and/or the device drivers it runs. OS exploits can freely ignore the protection between user applications, reading your banking keys. Even if a relatively secure OS is run (like some of the BSD variants), the protection is not _that_ secure. Vulnerabilities are found periodically (albeit mostly by the OS developers rather than externally -- as far as we know). Plus also the user may be tricked into running trojaned device drivers. So one approach to improve this situation (protect the user from the risks of trojaned device drivers and too large and complex to realistically assure security of OSes) one could run the OS itself in ring0 and a key store and TOR in ring-1 (the palladium approach). Some seem to be arguing that you don't need a ring-1. But if you read the paper Peter provided a reference for, they conclude that the pentium architecture is not (efficiently) securely virtualizable. The problem area is the existance of sensitive but unprivileged instructions. The fact that VMWare works just means they used some tricks to make it practically virtualize some common OSes, not that it is no longer possible to write malicious software to run as user or privileged level inside the guest OS and have it escape the virtualization. (It is potentially inefficently securely virtualizable using complete software emulation, but this is highly inefficient). (Anonymous can continue on cypherpunks if Perry chooses to censor his further comments.) Adam -- http://www.cypherspace.net/

3 2

Go to Java. Go Now!
by Caravel UK 18 Sep '02

18 Sep '02

1 0

RESTORATION
by Peter 18 Sep '02

18 Sep '02

Hello Sir/Ma, Good day. I wish to share something beautiful with you but will need your permission to do so. My point of focus is one based on somebody I know, love and have a relationship with (whom I think you should meet too). His name is Jesus Christ. Please kindly hear me out. But if you do not wish to do so, simply delete this message from your mail box and don't bother about it in any way. Reading to this point is even enough worth thanking you for. If on the other hand, you do not mind granting me audience, then I imploy you to graciously accept my invitation to read on. I believe you will like it. I thank you. What I have to share with you is something very important. In fact, for me,it is the most important thing to talk about on this axis of existence. Sure, all men should pay attention to it. It is obvious that this world is a place filled with violence, uncertainties and atrocities which mock man's claims to decency. But it could have been better. Someone cares and an encounter with that caring personality is needed to guarantee lasting ease on earth and hereafter because in here is "...no continuing city..." (Heb.13:14). Besides, "...we are all as an unclean thing, and all our righteousness are as filthy rags;..." (Isa.64:6). The all important issue I would like to talk to you about is one that borders on where one would spend the rest of his or her life after dying physically. Listen up please. Confronting every man is this stark (and perhaps rude) reality that life continues after his or her last earthly breath. Sorry, there isn't anything like the state of nothingness after death (Heb.9:27). No. None. Eternity is great! It is endless! In fact, it is the lifetime of the never dying God. When we all eventually close our eyes in life here, we will surely open them in eternity - never to go back to correct any mistake done in the past. So the best we can do for ourselves in time now is to secure our chances of making it at last to God in heaven. And the agent of that security is the guy I started out talking to you about. He is self existent from eternity past (Prov.8). He could not be felt by man's conscious apparatuses i.e. his sense organs, so He had to take on a body (Heb.10:4-7) so that He could relate with humans like you and I in order to lead us back to God (Heb.2:14) from whom we logged off when Adam and Eve, our first parents sinned (Gen.3). The sin they committed stained the whole of the human race (Rom.5:16,17a,19,21). Little wonder King David quipped that "Behold I was shapen in iniquity; and in sin did my mother conceive me" (PS.51:5). Apostle Paul's own submission is "For all have sinned and come short of the glory of God" (Rom.3:23). But of more serious implication is it's consequence: The soul that sinneth, it shall die...(Ezek.18:20a). So only a sinless individual can offer help to it, something my hero did. His name again is Jesus Christ. Sinless from the start, He responded to the call for a saviour for mankind the instance it was made in heaven (Jh.10:17,18) and had to lay down His life in the process. "Why" you asked? Well, in spiritual parlance, life goes for life and by yielding to the temptation of the devil, Adam and Eve caused mankind to lose the life of God (Eph.4:18) but Christ paid the debt by dying on the cross of Calvary (Matt.27; Heb.9:22) and rising up again on the third day from the dead through the power of the Holy Spirit (Matt.28:1-6; Rom.6:4;1 Cor.15:3,4). Hallelujah! His action was a clear expression of God's unreserved love for mankind (Jh.3:16). Now, you and I need to willingly and consciously surrender the Lordship of our lives to Him in order to be secured from the eternal damnation of hell - out of God's holy presence. Please do note today that whoever allows Jesus into his or her life, would never live to regret the action taken (Rev.3:20; Jh.10:10). I therefore humbly invite you to do it now. The bible says whosoever comes to Christ, He would in no wise cast out (Jh.6:37). Whoever does so, is assured of eternal life (Jh.3:16). If you are ready to do the above, then simply follow these steps: First, acknowledge that you are a sinner who cannot save himself/herself no matter how much you try to. Second, believe in the provision that God has graciously made available for man to be saved - Jesus Christ (Acts 4:12). Then, simply say a prayer asking for forgiveness for your sins in Jesus name and He will save you (Ps.51:17). He is only the mention of His name far away from you. Your name will then be written in the book of life (Phil.4:3). That is when it is said that you are born again. That is when you can enjoy the true peace that only His spirit brings (Rom.14:11). That is when your own spirit is regenerated to be accostumed to His ways (Rom.8:10,11,14; 1 Cor.2:14,15). That is when you can safely escape the danger of eternal anguish for your immortal soul (Jh.3:18). However, you must be willing to depend on the sweet Holy Spirit to live a life which is pleasing to God. So are you born again or would you like to be now? Do take note that Jesus loves you dearly and He wants to save you today (Matt.11:28; Mk.10:45; Jh.6:36). Please give your heart to Him and you will be glad you did. I care about your welfare but God cares more. I am glad you could let me talk to you about Him. So I thank you very much for granting me your audience. May God bless you richly in Jesus name. Amen. Peter, Lagos.

1 0

RESTORATION
by Peter 18 Sep '02

18 Sep '02

Hello Sir/Ma, Good day. I wish to share something beautiful with you but will need your permission to do so. My point of focus is one based on somebody I know, love and have a relationship with (whom I think you should meet too). His name is Jesus Christ. Please kindly hear me out. But if you do not wish to do so, simply delete this message from your mail box and don't bother about it in any way. Reading to this point is even enough worth thanking you for. If on the other hand, you do not mind granting me audience, then I imploy you to graciously accept my invitation to read on. I believe you will like it. I thank you. What I have to share with you is something very important. In fact, for me,it is the most important thing to talk about on this axis of existence. Sure, all men should pay attention to it. It is obvious that this world is a place filled with violence, uncertainties and atrocities which mock man's claims to decency. But it could have been better. Someone cares and an encounter with that caring personality is needed to guarantee lasting ease on earth and hereafter because in here is "...no continuing city..." (Heb.13:14). Besides, "...we are all as an unclean thing, and all our righteousness are as filthy rags;..." (Isa.64:6). The all important issue I would like to talk to you about is one that borders on where one would spend the rest of his or her life after dying physically. Listen up please. Confronting every man is this stark (and perhaps rude) reality that life continues after his or her last earthly breath. Sorry, there isn't anything like the state of nothingness after death (Heb.9:27). No. None. Eternity is great! It is endless! In fact, it is the lifetime of the never dying God. When we all eventually close our eyes in life here, we will surely open them in eternity - never to go back to correct any mistake done in the past. So the best we can do for ourselves in time now is to secure our chances of making it at last to God in heaven. And the agent of that security is the guy I started out talking to you about. He is self existent from eternity past (Prov.8). He could not be felt by man's conscious apparatuses i.e. his sense organs, so He had to take on a body (Heb.10:4-7) so that He could relate with humans like you and I in order to lead us back to God (Heb.2:14) from whom we logged off when Adam and Eve, our first parents sinned (Gen.3). The sin they committed stained the whole of the human race (Rom.5:16,17a,19,21). Little wonder King David quipped that "Behold I was shapen in iniquity; and in sin did my mother conceive me" (PS.51:5). Apostle Paul's own submission is "For all have sinned and come short of the glory of God" (Rom.3:23). But of more serious implication is it's consequence: The soul that sinneth, it shall die...(Ezek.18:20a). So only a sinless individual can offer help to it, something my hero did. His name again is Jesus Christ. Sinless from the start, He responded to the call for a saviour for mankind the instance it was made in heaven (Jh.10:17,18) and had to lay down His life in the process. "Why" you asked? Well, in spiritual parlance, life goes for life and by yielding to the temptation of the devil, Adam and Eve caused mankind to lose the life of God (Eph.4:18) but Christ paid the debt by dying on the cross of Calvary (Matt.27; Heb.9:22) and rising up again on the third day from the dead through the power of the Holy Spirit (Matt.28:1-6; Rom.6:4;1 Cor.15:3,4). Hallelujah! His action was a clear expression of God's unreserved love for mankind (Jh.3:16). Now, you and I need to willingly and consciously surrender the Lordship of our lives to Him in order to be secured from the eternal damnation of hell - out of God's holy presence. Please do note today that whoever allows Jesus into his or her life, would never live to regret the action taken (Rev.3:20; Jh.10:10). I therefore humbly invite you to do it now. The bible says whosoever comes to Christ, He would in no wise cast out (Jh.6:37). Whoever does so, is assured of eternal life (Jh.3:16). If you are ready to do the above, then simply follow these steps: First, acknowledge that you are a sinner who cannot save himself/herself no matter how much you try to. Second, believe in the provision that God has graciously made available for man to be saved - Jesus Christ (Acts 4:12). Then, simply say a prayer asking for forgiveness for your sins in Jesus name and He will save you (Ps.51:17). He is only the mention of His name far away from you. Your name will then be written in the book of life (Phil.4:3). That is when it is said that you are born again. That is when you can enjoy the true peace that only His spirit brings (Rom.14:11). That is when your own spirit is regenerated to be accostumed to His ways (Rom.8:10,11,14; 1 Cor.2:14,15). That is when you can safely escape the danger of eternal anguish for your immortal soul (Jh.3:18). However, you must be willing to depend on the sweet Holy Spirit to live a life which is pleasing to God. So are you born again or would you like to be now? Do take note that Jesus loves you dearly and He wants to save you today (Matt.11:28; Mk.10:45; Jh.6:36). Please give your heart to Him and you will be glad you did. I care about your welfare but God cares more. I am glad you could let me talk to you about Him. So I thank you very much for granting me your audience. May God bless you richly in Jesus name. Amen. Peter, Lagos.

1 0

RESTORATION
by Peter 18 Sep '02

18 Sep '02

Hello Sir/Ma, Good day. I wish to share something beautiful with you but will need your permission to do so. My point of focus is one based on somebody I know, love and have a relationship with (whom I think you should meet too). His name is Jesus Christ. Please kindly hear me out. But if you do not wish to do so, simply delete this message from your mail box and don't bother about it in any way. Reading to this point is even enough worth thanking you for. If on the other hand, you do not mind granting me audience, then I imploy you to graciously accept my invitation to read on. I believe you will like it. I thank you. What I have to share with you is something very important. In fact, for me,it is the most important thing to talk about on this axis of existence. Sure, all men should pay attention to it. It is obvious that this world is a place filled with violence, uncertainties and atrocities which mock man's claims to decency. But it could have been better. Someone cares and an encounter with that caring personality is needed to guarantee lasting ease on earth and hereafter because in here is "...no continuing city..." (Heb.13:14). Besides, "...we are all as an unclean thing, and all our righteousness are as filthy rags;..." (Isa.64:6). The all important issue I would like to talk to you about is one that borders on where one would spend the rest of his or her life after dying physically. Listen up please. Confronting every man is this stark (and perhaps rude) reality that life continues after his or her last earthly breath. Sorry, there isn't anything like the state of nothingness after death (Heb.9:27). No. None. Eternity is great! It is endless! In fact, it is the lifetime of the never dying God. When we all eventually close our eyes in life here, we will surely open them in eternity - never to go back to correct any mistake done in the past. So the best we can do for ourselves in time now is to secure our chances of making it at last to God in heaven. And the agent of that security is the guy I started out talking to you about. He is self existent from eternity past (Prov.8). He could not be felt by man's conscious apparatuses i.e. his sense organs, so He had to take on a body (Heb.10:4-7) so that He could relate with humans like you and I in order to lead us back to God (Heb.2:14) from whom we logged off when Adam and Eve, our first parents sinned (Gen.3). The sin they committed stained the whole of the human race (Rom.5:16,17a,19,21). Little wonder King David quipped that "Behold I was shapen in iniquity; and in sin did my mother conceive me" (PS.51:5). Apostle Paul's own submission is "For all have sinned and come short of the glory of God" (Rom.3:23). But of more serious implication is it's consequence: The soul that sinneth, it shall die...(Ezek.18:20a). So only a sinless individual can offer help to it, something my hero did. His name again is Jesus Christ. Sinless from the start, He responded to the call for a saviour for mankind the instance it was made in heaven (Jh.10:17,18) and had to lay down His life in the process. "Why" you asked? Well, in spiritual parlance, life goes for life and by yielding to the temptation of the devil, Adam and Eve caused mankind to lose the life of God (Eph.4:18) but Christ paid the debt by dying on the cross of Calvary (Matt.27; Heb.9:22) and rising up again on the third day from the dead through the power of the Holy Spirit (Matt.28:1-6; Rom.6:4;1 Cor.15:3,4). Hallelujah! His action was a clear expression of God's unreserved love for mankind (Jh.3:16). Now, you and I need to willingly and consciously surrender the Lordship of our lives to Him in order to be secured from the eternal damnation of hell - out of God's holy presence. Please do note today that whoever allows Jesus into his or her life, would never live to regret the action taken (Rev.3:20; Jh.10:10). I therefore humbly invite you to do it now. The bible says whosoever comes to Christ, He would in no wise cast out (Jh.6:37). Whoever does so, is assured of eternal life (Jh.3:16). If you are ready to do the above, then simply follow these steps: First, acknowledge that you are a sinner who cannot save himself/herself no matter how much you try to. Second, believe in the provision that God has graciously made available for man to be saved - Jesus Christ (Acts 4:12). Then, simply say a prayer asking for forgiveness for your sins in Jesus name and He will save you (Ps.51:17). He is only the mention of His name far away from you. Your name will then be written in the book of life (Phil.4:3). That is when it is said that you are born again. That is when you can enjoy the true peace that only His spirit brings (Rom.14:11). That is when your own spirit is regenerated to be accostumed to His ways (Rom.8:10,11,14; 1 Cor.2:14,15). That is when you can safely escape the danger of eternal anguish for your immortal soul (Jh.3:18). However, you must be willing to depend on the sweet Holy Spirit to live a life which is pleasing to God. So are you born again or would you like to be now? Do take note that Jesus loves you dearly and He wants to save you today (Matt.11:28; Mk.10:45; Jh.6:36). Please give your heart to Him and you will be glad you did. I care about your welfare but God cares more. I am glad you could let me talk to you about Him. So I thank you very much for granting me your audience. May God bless you richly in Jesus name. Amen. Peter, Lagos.

1 0

RESTORATION
by Peter 18 Sep '02

18 Sep '02

Hello Sir/Ma, Good day. I wish to share something beautiful with you but will need your permission to do so. My point of focus is one based on somebody I know, love and have a relationship with (whom I think you should meet too). His name is Jesus Christ. Please kindly hear me out. But if you do not wish to do so, simply delete this message from your mail box and don't bother about it in any way. Reading to this point is even enough worth thanking you for. If on the other hand, you do not mind granting me audience, then I imploy you to graciously accept my invitation to read on. I believe you will like it. I thank you. What I have to share with you is something very important. In fact, for me,it is the most important thing to talk about on this axis of existence. Sure, all men should pay attention to it. It is obvious that this world is a place filled with violence, uncertainties and atrocities which mock man's claims to decency. But it could have been better. Someone cares and an encounter with that caring personality is needed to guarantee lasting ease on earth and hereafter because in here is "...no continuing city..." (Heb.13:14). Besides, "...we are all as an unclean thing, and all our righteousness are as filthy rags;..." (Isa.64:6). The all important issue I would like to talk to you about is one that borders on where one would spend the rest of his or her life after dying physically. Listen up please. Confronting every man is this stark (and perhaps rude) reality that life continues after his or her last earthly breath. Sorry, there isn't anything like the state of nothingness after death (Heb.9:27). No. None. Eternity is great! It is endless! In fact, it is the lifetime of the never dying God. When we all eventually close our eyes in life here, we will surely open them in eternity - never to go back to correct any mistake done in the past. So the best we can do for ourselves in time now is to secure our chances of making it at last to God in heaven. And the agent of that security is the guy I started out talking to you about. He is self existent from eternity past (Prov.8). He could not be felt by man's conscious apparatuses i.e. his sense organs, so He had to take on a body (Heb.10:4-7) so that He could relate with humans like you and I in order to lead us back to God (Heb.2:14) from whom we logged off when Adam and Eve, our first parents sinned (Gen.3). The sin they committed stained the whole of the human race (Rom.5:16,17a,19,21). Little wonder King David quipped that "Behold I was shapen in iniquity; and in sin did my mother conceive me" (PS.51:5). Apostle Paul's own submission is "For all have sinned and come short of the glory of God" (Rom.3:23). But of more serious implication is it's consequence: The soul that sinneth, it shall die...(Ezek.18:20a). So only a sinless individual can offer help to it, something my hero did. His name again is Jesus Christ. Sinless from the start, He responded to the call for a saviour for mankind the instance it was made in heaven (Jh.10:17,18) and had to lay down His life in the process. "Why" you asked? Well, in spiritual parlance, life goes for life and by yielding to the temptation of the devil, Adam and Eve caused mankind to lose the life of God (Eph.4:18) but Christ paid the debt by dying on the cross of Calvary (Matt.27; Heb.9:22) and rising up again on the third day from the dead through the power of the Holy Spirit (Matt.28:1-6; Rom.6:4;1 Cor.15:3,4). Hallelujah! His action was a clear expression of God's unreserved love for mankind (Jh.3:16). Now, you and I need to willingly and consciously surrender the Lordship of our lives to Him in order to be secured from the eternal damnation of hell - out of God's holy presence. Please do note today that whoever allows Jesus into his or her life, would never live to regret the action taken (Rev.3:20; Jh.10:10). I therefore humbly invite you to do it now. The bible says whosoever comes to Christ, He would in no wise cast out (Jh.6:37). Whoever does so, is assured of eternal life (Jh.3:16). If you are ready to do the above, then simply follow these steps: First, acknowledge that you are a sinner who cannot save himself/herself no matter how much you try to. Second, believe in the provision that God has graciously made available for man to be saved - Jesus Christ (Acts 4:12). Then, simply say a prayer asking for forgiveness for your sins in Jesus name and He will save you (Ps.51:17). He is only the mention of His name far away from you. Your name will then be written in the book of life (Phil.4:3). That is when it is said that you are born again. That is when you can enjoy the true peace that only His spirit brings (Rom.14:11). That is when your own spirit is regenerated to be accostumed to His ways (Rom.8:10,11,14; 1 Cor.2:14,15). That is when you can safely escape the danger of eternal anguish for your immortal soul (Jh.3:18). However, you must be willing to depend on the sweet Holy Spirit to live a life which is pleasing to God. So are you born again or would you like to be now? Do take note that Jesus loves you dearly and He wants to save you today (Matt.11:28; Mk.10:45; Jh.6:36). Please give your heart to Him and you will be glad you did. I care about your welfare but God cares more. I am glad you could let me talk to you about Him. So I thank you very much for granting me your audience. May God bless you richly in Jesus name. Amen. Peter, Lagos.

1 0

$100 turns into $16,000 - Immediate Results! 5199smlY1-726JnDY0859PRxM8-33-27
by Denis2188u67＠aol.com 17 Sep '02

17 Sep '02

1 0

CASH IN YOUR PAYPAL TOMORROW!! 6139-4
by lisa2111w51＠aol.com 17 Sep '02

17 Sep '02

1 0

dripping Xlips gfsmn
by Valerie* 17 Sep '02

17 Sep '02

1 0

Bush admin cybersecurity report weighs anonymity
by Declan McCullagh 17 Sep '02

17 Sep '02

----- Forwarded message from Declan McCullagh <declan(a)well.com> -----

2 1

Re: Cryptogram: Palladium Only for DRM
by AARG! Anonymous 17 Sep '02

17 Sep '02

Niels Ferguson wrote: > At 16:04 16/09/02 -0700, AARG! Anonymous wrote: > >Nothing done purely in software will be as effective as what can be done > >when you have secure hardware as the foundation. I discuss this in more > >detail below. > > But I am not suggesting to do it purely in software. Read the Intel manuals > for their CPUs. There are loads of CPU features for process separation, > securing the operating system, etc. The hardware is all there! > Maybe I have to explain the obvious. On boot you boot first to a secure > kernel, much like the Pd kernel but running on the main CPU. This kernel > then creates a virtual machine to run the existing Windows in, much like > VMware does. The virus is caught inside this virtual machine. All you need > to do is make sure the virtual machine cannot write to the part of the disk > that contains your security kernel. Thanks for the explanation. Essentially you can create a virtualized Palladium, where you emulate the functionality of the secure hardware. The kernel normally has access to all of memory, for example, but you can virtualize the MMU as VmWare does, so that some memory is inaccessible even to the kernel, while the kernel can still run pretty much the same. Similarly your virtualizing software could comput a hash of code that loads into this secure area and even mimic the Palladium functionality to seal and unseal data based on that hash. All this would be done at a level which was inaccessible to ordinary Windows code, so it would be basically as secure as Palladium is with hardware. The one thing that you don't get with this method is secure attestation. There is no way your software can prove to a remote system that it is running a particular piece of code, as is possible with Pd hardware. However I believe you see this as not a security problem, since in your view the only use for such functionality is for DRM. I do think there are some issues with this approach to creating a secure system, even independent of the attestation issue. One is performance. According to a presentation by the VMWare chief scientist [1], VMWare sees slowdowns of from 8 to 30 percent on CPU-bound processes, with graphics-intensive applications even worse, perhaps a factor of 2 slower. Maybe Windows could do better than this, but users aren't going to be happy about giving up 10 percent or more of their CPU performance. Also, Palladium hardware provides protection against DMA devices: "Even PCI DMA can't read or write memory which has been reserved to a nub's or TA's use (including the nub's or TA's code). This memory is completely inaccessible and can only be accessed indirectly through API calls. The chipset on the motherboard is modified to enforces this sort of restriction." [2] It's conceivable that without this hardware protection, a virus could exploit a security flaw in an external device and get access to the secure memory provided by a virtualized Palladium. But these are not necessarily major problems. Generally I now agree with your comments, and those of others, that the security benefits of Palladium - except for secure remote attestation - can be provided using existing and standard PC hardware, and that the software changes necessary are much like what would be necessary for the current Palladium design, plus the work to provide VMWare-type functionality. However that still leaves the issue of remote attestation... > Who are you protecting against? If the system protects the interests of the > user, then you don't need to protect the system from the user. The security > chip is only useful if you try to take control away from the user. This is a simplistic view. There are many situations in which it is in the interests of the user to be able to prove to third parties that he is unable to commit certain actions. A simple example is possession of a third-party cryptographic certificate. The only reason that is valuable is because the user can't create it himself. Any time someone shows a cert, they are giving up some control in order to get something. They can't modify that certificate without rendering it useless. They are limited in what they can do with it. But it is these very limitations that make the cert valuable. But let me cut to the chase and provide some examples where remote attestation, allowing the user to prove that he is running a particular program and that it is unmolested, is useful. These will hopefully encourage you to modify your belief that "The 'secure chip' in Pd is only needed for DRM. All other claimed benefits of Pd can be achieved using existing hardware. To me this is an objectively verifyable truth." I don't think any of these examples could be solved with software plus existing hardware alone. The first example is a secure online game client. Rampant cheating in the online gaming industry is a major problem which has gotten much attention in the past few months. Players can load hacks to let them see through walls, automate targetting and fire control, and employ other methods that give them an overwhelming advantage. The game industry is big business and is growing rapidly. Unless they can get a handle on this problem it could hurt the success of the industry. Remote attestation will allow game servers to be confident that users are playing on a level playing field, without the hacked and modified clients that allow cheating. Another example is a P2P file sharing network client. Faced with the threat from these file sharing networks, content industries are attacking them in various ways, including flooding them with bogus queries and lying about file hashes and contents. Also, some users are switching to clients that give them unfair priority, at the expense of the rest of the network. Recently a Salon article [3] reported that Gnutella developers are considering methods to check client integrity in order to avoid these problems. But this is not really possible today, especially with open source clients. What they need is secure attestation. That way they can be confident that client software is using the protocol fairly and appropriately. Of course, the Gnutella developers have no idea that the evil bogeyman of Palladium could actually help them out - no one in the security field is willing to say anything favorable about the technology. This conspiracy of silence is what I am trying to overcome. Online distributed computations can also benefit. Recently there was a comment on cypherpunks that pointed out that the RC5 keysearch effort has gone through 85% of the key space without success, raising the possibility that it somehow skipped the key. This particular search has gone on for almost five years, and all that work may come to nothing! Being able to check that users are running valid clients will eliminate one possible source of problems in these efforts. Remote attestation will be an easy way to improve the chances that if someone says that the key is not in a particular region, it really isn't. Turning to banking and e-commerce, there are many cases where it is not enough to be running a secure client; you must also be able to prove that you are doing so. According to Perry Metzger's earlier message, if a user is defrauded in a banking transaction due to a virus, he is supposed to be protected. It's not clear who has to pay him back, but let's suppose it is the bank. Now the bank has a very real economic interest in making sure that its clients are using the approved software. If there is third-party software out there, the bank can't be sure of its reliability and security. Secure attestation can improve the security of the entire system by making sure that third-party clients are not allowed to participate in transactions. The bank has control over its liability and its risk. The same reasoning applies to credit card purchases. If you've got a virtual-Palladium-based secure system, that's great; you're protected against a virus somehow getting your card number and using it. But actually it is the banks who eat the charges when cards are misused, at least in the U.S. It could make a great deal of sense for acceptors of credit cards to be able to check what software the user is running, make sure it is a secure system and that it is an approved client. This will give users incentives to move to secure systems, which will benefit everyone as the amount of fraud decreases. Secure attestation could even provide a way for commercial companies to prove to customers that they are running particular accounting software to hold data on their customers. Eventually, accounting software could be developed which is oriented around protecting the privacy of consumer data; for example, it could prevent wholesale exporting of the database into some format that could be easily copied or transferred. User agents could refuse to upload their personal data unless the company can prove that it is running one of these privacy-protecting software packages. Adam Back (who opposes Palladium) described several other possible applications all of which rely on secure attestation [4]. He listed: : - general Application Service Providers (ASPs) that you don't have to : trust to read your data : : - less traceable peer-to-peer applications : : - DRM applications that make a general purpose computer secure against : BORA (Break Once Run Anywhere), though of course not secure against : ROCA (Rip Once Copy Everywhere) -- which will surely continue to : happen with ripping shifting to hardware hackers. : : - general purpose unreadable sandboxes to run general purpose : CPU-for-rent computing farms for hire, where the sender knows you : can't read his code, you can't read his input data, or his output : data, or tamper with the computation. : : - file-sharing while robustly hiding knowledge and traceability of : content even to the node serving it -- previously research question, : now easy coding problem with efficient : : - anonymous remailers where you have more assurance that a given node : is not logging and analysing the traffic being mixed by it Of course, one of these is indeed DRM, and no one (least of all Microsoft) denies that DRM will be facilitated by Palladium or that it was one of the motivations for creating the technology. But the rest are all different, and hopefully they provide further evidence that Palladium, in its full form, is good for more than DRM. In particular, the idea of CPU-for-rent farms has been stymied for years because of concerns about sensitive corporate data. Secure attestation could be a breakthrough that will put the incredible power of idle machines to productive economic use, for tremendous benefits to society. The virtualized Palladium can't do any of the applications above, as far as I can see. These are all benefits of Palladium which rely on the secure hardware chip, and they go far beyond DRM. Many of these applications actually serve to enhance the user's security and privacy. I understand you aren't going to reply, but hopefully in your own mind you will see that there are far more benefits to the full version of Palladium, including its security chip, than just DRM. === [1] http://www.hotchips.org/pubs/hc99/hc11_pdf/hc99.s6.1.Rosenblum.pdf [2] http://vitanuova.loyalty.org/2002-07-05.html [3] http://www.salon.com/tech/feature/2002/08/08/gnutella_developers/print.html [4] http://www.mail-archive.com/cryptography@wasabisystems.com/msg02526.html

1 0

Vaccine developed for lethal ricin
by R. A. Hettinga 17 Sep '02

17 Sep '02

--- begin forwarded text

1 0

Palladium block diagram
by AARG! Anonymous 17 Sep '02

17 Sep '02

Here is a functional block diagram of the Palladium software, based on a recent presentation by Microsoft. My notes were a bit sketchy as I rushed to copy down this slide, so there may be some slight errors. But this is basically what was shown. (Use a monospace font to see it properly.) Normal Mode Trusted Mode +-----------------------------------------------------------------+ | +-------+ | +-------+ | | Nubsys | App |---o | o---| Agent | | USER | exe | PdLib | | | PdLib | | | o +-------+ | +-------+ | | | | o | | | | | | |--------|----------------------------+-----------|---------------| | \-----------------\ | | | | | | | | | +---------+ +--------+ | +------------------+ | | | Main OS | | NubMgr |--o | o--| Secure Executive | | KERNEL | ++----+----+----+ | sys | | | Nexus | | | | HAL | Drivers | +--------+ | +------------------+ | | +-----+---------+ | | | | | +-----------------------------------------------------------------+ The idea is that initially only the left half exists. To launch Palladium the user runs the Nubsys.exe program. This goes into kernel mode and loads the NubMgr.sys module, which initiates trusted mode and launches the secure executive or "nexus". (This is what is also sometimes called the Nub or the TOR.) When a Palladium-aware app is launched in user mode, it is linked with a PdLib and requests to the Nexus to load the corresponding Trusted Agent. The Agent runs trusted in user mode, and has its own PdLib which lets it make system calls into the Nexus. The Trusted Agent and the application then communicate back and forth across the trusted/normal mode boundary.

1 0

algebra.com becomes a more filtered node
by Igor Chudov 17 Sep '02

17 Sep '02

Just wanted to let everyone know that algebra.com is becoming a much more filtered node. Two things to be aware of: 1. I use a lot more of general antispam filtering. I use several dns based spamhaus blackholes, a access control list from wirehub.net, and my own list of spam patterns. At request of other nodes, I can share what I do which at this point has become rather effective. Spam that passes through other nodes is more difficult for me to eliminate. 2. (more controversial). I eliminate all traffic that I receive from, or that was sent to, one particular cypherpunk node, as well as everything that was sent by the node's owner. Essentially all traffic that is related to that node goes to the bit bucket. I am rather tired of both the content as well as the network bandwidth consumed by that node. I send nothing to that node either. The goal that I personally pursue is to make the list more readable to me and to use less of my bandwodth. I am not even sure how many valid addresses are subscribed to algebra.com, since I transferred a lot of them to minder.net a while ago. igor

1 0

>>>14.5 MILLION TARGETED EMAIL ADDRESSES...PLUS $2,000 IN FREE SOFTWARE!
by Howard Fok 17 Sep '02

17 Sep '02

WOULD YOU LIKE TO HAVE YOUR MESSAGE SEEN BY OVER 14.5 MILLION TARGETED PROSPECTS DAILY? Below is all the information you will ever need to market your product or service over the Internet! If you have a product, service, or message that you would like to get out to Thousands, Hundreds of Thousands, or even Millions of people, you have several options. Traditional methods include print advertising, direct mail, radio, and television advertising. They are all effective, but they all have two catches: They're EXPENSIVE and TIME CONSUMING. Not only that, you only get ONE SHOT at making your message heard by the right people. Now this has all changed! Internet Search Engines Submissions, Classified Ads, Newsgroup Postings simply DO NOT WORK. Thanks to the top programmers in the world and their NEW EMAIL TECHNOLOGY, You can send millions of email messages daily for FREE... Without getting terminated from your current Internet connection! It's very simple to do and you can be increasing your sales within minutes of installing this new extraordinary software! Besides...It's the only real way to advertise on the Internet that works...Period! >>>WE WILL SUPPLY YOU WITH OVER 14.5 MILLION OPT-IN EMAIL ADDRESSES TO GET STARTED RIGHT AWAY! >>>PLUS FREE EMAIL ADDRESS DOWNLOADS FOR ONE FULL YEAR! >>>ALSO YOU WILL RECEIVE $2,000 WORTH OF INTERNET MARKETING SOFTWARE FREE! Including...... EMAIL SENDING SOFTWARE...(send millions of email advertisements daily with a few clicks of your mouse) EMAIL EXTRACTION SOFTWARE...(retreive new targeted email addresses daily hundreds of thousands of them) LIST MANAGEMENT SOFTWARE...(keep your lists clean, opt-in and manage all your remove requests, leads, sales etc...) and much...much more! To find out more information, Do not respond by email. Instead, visit our web site at: http://www.emailbythemillion.com _____________________________________________________ Want to be removed from our list? Simply send an email to us at cybernetremova(a)excite.com and type "remove" in the "subject" line and you will be removed from any future mailings.

1 0

>>>14.5 MILLION TARGETED EMAIL ADDRESSES...PLUS $2,000 IN FREE SOFTWARE!
by Maria King 17 Sep '02

17 Sep '02

WOULD YOU LIKE TO HAVE YOUR MESSAGE SEEN BY OVER 14.5 MILLION TARGETED PROSPECTS DAILY? Below is all the information you will ever need to market your product or service over the Internet! If you have a product, service, or message that you would like to get out to Thousands, Hundreds of Thousands, or even Millions of people, you have several options. Traditional methods include print advertising, direct mail, radio, and television advertising. They are all effective, but they all have two catches: They're EXPENSIVE and TIME CONSUMING. Not only that, you only get ONE SHOT at making your message heard by the right people. Now this has all changed! Internet Search Engines Submissions, Classified Ads, Newsgroup Postings simply DO NOT WORK. Thanks to the top programmers in the world and their NEW EMAIL TECHNOLOGY, You can send millions of email messages daily for FREE... Without getting terminated from your current Internet connection! It's very simple to do and you can be increasing your sales within minutes of installing this new extraordinary software! Besides...It's the only real way to advertise on the Internet that works...Period! >>>WE WILL SUPPLY YOU WITH OVER 14.5 MILLION OPT-IN EMAIL ADDRESSES TO GET STARTED RIGHT AWAY! >>>PLUS FREE EMAIL ADDRESS DOWNLOADS FOR ONE FULL YEAR! >>>ALSO YOU WILL RECEIVE $2,000 WORTH OF INTERNET MARKETING SOFTWARE FREE! Including...... EMAIL SENDING SOFTWARE...(send millions of email advertisements daily with a few clicks of your mouse) EMAIL EXTRACTION SOFTWARE...(retreive new targeted email addresses daily hundreds of thousands of them) LIST MANAGEMENT SOFTWARE...(keep your lists clean, opt-in and manage all your remove requests, leads, sales etc...) and much...much more! To find out more information, Do not respond by email. Instead, visit our web site at: http://www.emailbythemillion.com _____________________________________________________ Want to be removed from our list? Simply send an email to us at cybernetremova(a)excite.com and type "remove" in the "subject" line and you will be removed from any future mailings.

1 0

GET AN UNSECURED VISA OR MASTERCARD NOW!!
by Sweepsgame.com 17 Sep '02

17 Sep '02

Dear Member, You can get your credit back on track with a Centennial VISA or MasterCard! Get the credit you deserve while enjoying the benefits of ATM Cash Advances. http://www.ppmtrac.com/tk/121/ <a href="http://www.ppmtrac.com/tk/121/"> AOL Users Click Here</a> Remember, good credit is an important part of your financial future, and it's our pleasure to help you build that future. Plus get credit limit increase reviews so click below and APPLY NOW. So stop waiting! Apply Online NOW for your choice of an UNSECURED Centennial VISA or MASTERCARD Today! http://www.ppmtrac.com/tk/121/ <a href="http://www.ppmtrac.com/tk/121/"> AOL Users Click Here</a> Sincerely,Your New Offers Staff This email was sent to you by Sweepsgame.com, a marketing partner of First PREMIER Bank, not from the Bank itself.Please direct all concerns about this email or your inclusion on this list to our email address listed above. <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> * To remove yourself from this mailing list, point your browser to: http://i.mb00.net/remove?Sweepsgame:* * Enter your email address (cypherpunks(a)minder.net) in the field provided and click "Unsubscribe". The mailing list ID is "Sweepsgame:*". OR... * Forward a copy of this message to Sweepsgame(a)reply.mb00.net with the word remove in the subject line. <mailto:Sweepsgame@reply.mb00.net?subject=remove> This message was sent to address cypherpunks(a)minder.net X-PMG-Recipient: cypherpunks(a)minder.net <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> pmguid:1rp.33o1.18wkw

1 0

H.D. Motorcycle sweepstake
by Win-a-Bike 17 Sep '02

17 Sep '02

Forward: ------------------------------------------------------- Free signup limited seats available. Make sure you grab this golden opportunity while still valid. Enter the Harley-Davidson VISA sweepstake. -------------------------------------------------------- Join Harley-Davidson Visa Sweepstakes -------------------------------------------------------- Signup and enter to win a F-r-e-e bike. What are you waiting for? http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 -------------------------------------------------------- Why buy a bike? You could easily win a Harley! -------------------------------------------------------- This is not a dream. Just signup and get approval online and enter the Harley-Davidson Visa sweepstakes. http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 (Valid to U.S. residents age 18+ only) -------------------------------------------------------- YES, 2 simple steps to win a Bike. Monthly drawing. -------------------------------------------------------- No sign up, No monthly fee, easly approval, anybody can join to win a bike. What are you waiting for? http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 Dave Kawasaki HarleyFanClub announce(a)harleyfanclub.com ------------------------------------------------------- This Tell-a-Friend service is accessible online, you can do the same to invite your friends to join for free. Visit: http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 To unsubscribe, email: unsubscribe(a)harleyfanclub.com To make suggestions, email: suggestions(a)harleyfanclub.com -------------------------------------------------------

1 0

Fwd: Re: Claim your lucky draw ticket.
by Win-a-Bike 17 Sep '02

17 Sep '02

Forward: ------------------------------------------------------- Free signup limited seats available. Make sure you grab this golden opportunity while still valid. Enter the Harley-Davidson VISA sweepstake. -------------------------------------------------------- Signup to enter the sweepstakes every month! -------------------------------------------------------- Join and Win a FREE RIDE! We are giving away one Harley-Davidson motorcycle every month! http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 -------------------------------------------------------- Signup and test your luck. Why not? -------------------------------------------------------- Simply signup and enter the sweepstakes until December 31st 2002. No purchase, no obligations! http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 -------------------------------------------------------- Dream comes true. Win a Harley-Davidson Motorcycle. -------------------------------------------------------- Valid to U.S. residents age 18+ only. Sweepstakes end December 31st 2002. http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 Dave Kawasaki HarleyFanClub announce(a)harleyfanclub.com ------------------------------------------------------- This Tell-a-Friend service is accessible online, you can do the same to invite your friends to join for free. Visit: http://www.harleyfanclub.com/cgi-bin/offer.cgi?affid=63 To unsubscribe, email: unsubscribe(a)harleyfanclub.com To make suggestions, email: suggestions(a)harleyfanclub.com -------------------------------------------------------

1 0

[fc] FC'03 submission deadline - final reminder
by R. A. Hettinga 16 Sep '02

16 Sep '02

--- begin forwarded text

1 0

Silver Coin Giveaway
by trader4489＠excite.com 16 Sep '02

16 Sep '02

The new bull market in precious metals has started! To introduce this new investment opportunity, we would like your permission to send you a FREE silver coin and report!! Gold has broken through the $300.00 mark, and silver is experiencing the greatest supply shortfall in history! Find out NOW how precious metals can improve your overall investment returns. Click here for your FREE market report and silver coin: http://www.all-sensationals.com/invest/silver.html Gold has been as high as $875, and silver has been as high as $50. Analysts are predicting $10-15 silver over the near term. Global turmoil and economic instability indicate that an explosive flight to precious metals is upon us. Highly respected analysts covering the precious metals markets are calling for the beginning of the next bull market in silver and gold! http://www.all-sensationals.com/invest/silver.html Learn how with as little as $5000 you can own and leverage 3000 ounces of silver with low risk and potentially return $20,000 to $30,000 with a proper market move. This investment represents the purchase and leverage of physical metal. It does not involve futures or options or the risk associated with them. Find out today about this cutting edge opportunity! http://www.all-sensationals.com/invest/silver.html All information is FREE and is presented without obligation. Visit our website today for more details if you are at least 25 years of age. $5000 minimum investment. http://www.all-sensationals.com/invest/silver.html Disclaimer: We are strongly against sending unsolicited emails to those who do not wish to receive our special mailings. You have opted in to one or more of our affiliate sites requesting to be notified of any special offers we may run from time to time. We also have attained the services of an independent 3rd party to overlook list management and removal services. This is NOT unsolicited email. If you do not wish to receive further mailings, please click this link: http://www.all-sensationals.com/invest/cleanlist.html Please accept our apologies if you have been sent this email in error. We honor all removal requests. 3889jhMc6-844EGVf9644WEou5-555dl29

1 0

attention needed
by lawringschaka 16 Sep '02

16 Sep '02

From: South Africa. Hello, How are you? Although we have not met before,but this golden opportunity will bind us together. I am a retired Airforce pilot, and currently the chairman of the procurement committee for South Africa Air defence. I need your coperation. A recent contract for the purchase of Fighter/bomber planes was awarded, but we inflated the contract value with Ten Million Pound Sterlings. We need a Third Party for the collection of this excess value, we are highly connected and there is no risk involved, you will not appear in person for the collection of the said sum. We shall give you 15% commission. If you are interested get back to me and include your Telephone number so that I will give you further information. If you want call me, put your country acess code+2348033361804 and dial direct. Keep secret. Best regards, Mr Rawlings C.

1 0

+++ What You Don't Know Can Make You Rich => $1,500+/Wk Easy Cash for Ya!!!
by Roderick Gatchalian 16 Sep '02

16 Sep '02

1 0

+++ What You Don't Know Can Make You Rich => $1,500+/Wk Easy Cash for Ya!!!
by Roderick Gatchalian 16 Sep '02

16 Sep '02

1 0

dripping Xlips aix
by Nicki 16 Sep '02

16 Sep '02

1 0

ADULT ADV: Bored? Horny? FREE XXX!!!
by Megan 16 Sep '02

16 Sep '02

Content-Type: multipart/alternative; boundary="4j40RuZ6BnM7ciCKrS3PcTm5v" This is a Multipart message in MIME Format... --4j40RuZ6BnM7ciCKrS3PcTm5v Content-Type: text/plain Content-Transfer-Encoding: 8bit ~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~> ~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~> DAZZLING BEAUTIES!!!! ULTIMATE SEX SCENES!!!! LIVE STRIPPERS!!! TEEN HARDCORE!! THE HOTTEST MODELS!!! HIDDEN CAMS!!!! REAL SEX MALL! http://links.lifetimebucks.com/realsexmall/life.link/mctahoe/091502b ~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~> ~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~>~> ~ GRANNY PLAYGROUND Indulge in erotic lesbian encounters, Orgy bang-fests, women sucking dick, Big boob action and MUCH MORE! CUM ON IN! DON'T MISS THE ACTION!! http://www9.grannyplayground.com/cgi/click?account=720268&site=34&program=1 __________________________________________________________________________________ __________________________________________________________________________________ This message is being sent to you because you are a member of Xxxtasy Mail. To change your subscription please visit: http://event.xxxtasymail.com/remove.cgi?key=aa2d2c482e2f2d2b2e2c30b2&email=… © Copyright Protected - All Rights Reserved Copyrights on exclusive images, video and text within this site strictly enforced. All Models were 18 years old or older when photos were taken. --4j40RuZ6BnM7ciCKrS3PcTm5v Content-Type: text/html Content-Transfer-Encoding: 8bit <html> <head> <title>Xxxtasy Mail</title> </head> <body bgcolor="#D6B5B5" leftmargin="0" topmargin="0" marginwidth="0"> <br><br> <table width="500" border="0" cellspacing="0" cellpadding="0" align="center"> <tr> <td><a href="http://links.lifetimebucks.com/realsexmall/life.link/mctahoe/091502b" target="_blank"><img src="http://209.132.192.13/xtc/xtc_lbtmegapornbucks_091502/images/realsexmall2.j…" alt="" width="500" height="307" border="0"></a></td> </tr> <tr> <td> </td> </tr> </table> <table width="469" border="1" cellspacing="0" cellpadding="0" align="center" bordercolor="#000000"> <tr> <td><a href="http://www9.grannyplayground.com/cgi/click?account=720268&site=34&program=1" target="_blank"><img src="http://209.132.192.13/xtc/xtc_lbtmegapornbucks_091502/images/megapornbucks.…" alt="" width="468" height="80" border="0"></a></td> </tr> </table> <table width="500" border="0" cellspacing="0" cellpadding="0" align="center" bgcolor="#D6B5B5"> <tr> <td> </td> </tr> <tr> <td> <p align="center"><font face="Arial, Helvetica, sans-serif" size="2" color="#ffffff">This message is being sent to you because you are a member of Xxxtasy Mail. <br> To change your subscription please visit: <a href="http://event.xxxtasymail.com/remove.cgi?key=fb1112060c0b110f0c120e27&email=…"><b>THIS LINK </a></b><br> <br> <font size="1">© Copyright Protected - All Rights Reserved <br> Copyrights on exclusive images, video and text within this site strictly enforced.<br> All Models were 18 years old or older when photos were taken.</font></font></p> </td> </tr> <tr> <td> </td> </tr> </table> <img src="http://adserv.exxxit.com/cgi-bin/omnidirect.cgi?SID=56&PID=4&LID=58" alt="" width="1" height="1" border="0"> </body> </html> --4j40RuZ6BnM7ciCKrS3PcTm5v--

1 0

What becomes a location most? (net core buildings)
by Major Variola (ret) 16 Sep '02

16 Sep '02

excerpts from http://mappa.mundi.net/inform/inform_0190.html The Seattle building had so much fiber running between floors that one elevator shaft was eliminated to make room. I believe this is the first time that I know of where people space in an office building has been replaced with electron (or photon) space. (Amusingly, the Seattle offices had a simple $100 hub that connected three of the Alaska providers to each other. But that was probably all that was needed.)

1 0

SOHO成功案例，月收入3000元名单
by SOHO 16 Sep '02

16 Sep '02

1 0

dripping Xlips uyhtb
by Nicki 16 Sep '02

16 Sep '02

1 0