December 2003 - cypherpunks-legacy

Java & Netscape security (reply to misc. postings)
by mrm＠netcom.com 17 Dec '03

17 Dec '03

Hi Harry & Perry & Jeff & Dr Cohen & "Alice" - 1. Netscape security: Like Jeff said, Netscape 2.0beta has all the same security features as JDK beta. (JDK = Java Developer's Kit, the name for our current product.) Netscape and Sun have been cooperating closely to implement, and test, and document the applet security model. The applet security manager and the applet class loader are implemented at the Java layer, for which source code is available from Sun. Granted, some elements of the the applet security model are implemented at the Java<-->runtime level, and that's why we have tests that we run on the appletviewer and on Netscape Navigator. 2. Corporate security class: Harry asks: | My question is, can a corporate user replace the security class in | Netscape. I understand that all the class libs are in an external | file. While a virus might exploit this... my reason for asking is for | corporate developers who are building "intra"net systems.. making some | tweaks to the security class would give them the flexibility they need. | Otherwise we have taken much of the fun out of Java. (for good | reasons). The best thing to do if you want to implement your own intra-corporation security model in the short run is to get a copy of the beta source code, and take a look at AppletSecurity.java and AppletClassLoader.java. You can substitute your own versions of those for your inhouse use. This is relatively easy to do with the appletviewer, and although it's possible to do some binary hack on moz2_0.car and replace certain files with your own, it's probably not everyone's cup of tea. I mean, there's a difference between what you can do, and what you want to do ... I understand that! For the next release, we are working on how to enable people to accomplish what you want to accomplish, in a standard way and in a usable way, which preserves the applet security model. The goal is to design the APIs so that applets can have access to more system functionality in a secure way. Presumably what you really want to do is write applets that have access to file i/o (or what have you), not re-implement the security manager. 3. Postscript considered dangerous: (insert-smiley) As for the question of someone invoking a postscript interpreter via a browser and thus opening up their system to some rogue postscript file: I think it would be great if either of these two things were to magically happen: 1) people would stop putting postscript docs on web pages because it's the wrong technology for WWW - it wastes bandwidth - it's hard to view & hence often ugly - everyone just prints it out anyway and then complains because there is no one "standard" implementation of postscript printing worldwide and there are dozens of minor problems 2) someone could implement a secure postscript previewer (whatever that means!) I doubt either of those two things will happen. The average Jo on the internet needs to understand that when s/he downloads binary files over the internet and run them from insecure programs on their local computer, well, s/he runs some risk. This risk might be tiny, but it's impossible to quantify loss. If I lose a poem that I'm writing, to me that's priceless, so I do not intend to imply that loss of data isn't tragic for the person who loses it. If you have data you can't bear to lose, be sure to practice safe computing. Perform backups regularly, and use judgement about which interpreters and executable programs you allow to run on your PC. Marianne -- internet fan, mrm(a)netcom.com Java Products Group, mrm(a)eng.sun.com

10 13

Evil Mail
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

WSJ, November 15, 1995 America Online to Warn Users About Bad E-Mail Vienna, Va. -- It's a case of myth becoming reality in the digital age. America Online Inc. plans to warn subscribers of a damaging piece of electronic mail that could corrupt their computers' hard drives. The existence of the destructive file follows a long-term hoax that has been dogging AOL for months. Last year, a user began circulating a warning about a "Good Times" virus that would crash users' PCs if they so much as read the piece of electronic mail. AOL, the Federal Communications Commission and the Pentagon repeatedly had to label the alleged virus a hoax. But the new file is all too real. The destructive file, attached to electronic mail, has been circulated through the on-line service and the Internet. Receiving the e-mail wouldn't harm a user's computer, but trying to run the attached file, known as AOL Gold or "install.exe," could render a hard drive inoperable, an AOL spokeswoman said. The company said it has notified various computer-security agencies about the program. AOL also plans to post a letter for its four million users strongly urging them to forgo "downloading attached files from people you don't know." Security experts fear that such Trojan Horses will proliferate as programs become easier to attach to electronic mail and the use of networks grows. -----

1 0

Re: e$: Come aaaannnndddd Get it!
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Incidentally, I would like to apologize if I am going over (and not contributing anything new to) discussion that has already taken place. If anyone has or knows of an archive of the earlier list messages on the subject (before I subscribed), I would like to read over them. From: tcmay(a)got.net at 16-NOV-1995 13:00:29.05: At 12:18 PM 11/16/95, Robert Hettinga wrote: > >Ahhh. Next year in Jeresalem... ----------- Although I am unfortunately not completely familiar with this phrase, I believe that your meaning here may be that I may be too much of an idealist. My position is that I will not use a digital cash system with the significant deficits in privacy that the ecash system has. The only exception to this stance would be if it becomes plain that it is the only alternative to a credit card system. Admittedly, as has been pointed out to me in private email, some degree of increased privacy in the ecash system can be gotten via changing currencies using ecash. An example would be dollars to yen through one changer and back again through another. However, I will not regard a digital cash system as truly good until it has the following traits: A. Private to any combination except all three of bank, sender, and receiver. B. The bank does not know the amount transacted or owned, unless it is the sender or receiver. (Obviously, it will know the total amount of digital cash of its issuance in existence, and how much it has received from or sent to each person, but it should not need to know anything more). C. Double spending is detectable, but does not reveal the identity of the individual. Thus, the bank does not need to know the identity of the individual when issuing the digital cash. The following are desirable but not strictly neccessary characteristics: A. Offline transactions are possible. To detect double spending, a transaction with the bank will probably be necessary, but this should ideally be postponable until the goods purchased are shipped. B. Mathematical as opposed to computational authentication and privacy. Since I am neither a mathematician nor a programmer, I am uncertain about whether this last is possible. I have my doubts. -------------- >Tell me, are you actually selling something on the net yet? How many >customers do you have? -------------- If A. such a system as the above were set up and B. I had available any computer programs, etcetera necessary to use it, then I would at least _try_ selling something on the net. This something would be not data itself, but true information- data with interpretations. I am qualified to produce such a service in some areas in biology and medicine. I am currently in a Ph.D. program in Molecular Genetics and Microbiology, and my chief area of interest is gene therapy- I have thus learned some things about human physiology. Perhaps more importantly than my own knowledge and experience, I know who to ask and have such individuals available. Admittedly, I would have to fit it into the time between exams, or more likely between semesters. -------------- Bob, let me do a minor vent here. You are critical of E. Allen Smith's viewpoint, and essentially question whether he has anything to sell. Not much of an argument. --------------- Thank you. (I would say "Thank you for your support," but my name is neither Bartles (sp?) or James.) --------------- Especially when folks are urging that "people put their money where their mouth is" and get MTB accounts. Me, I don't plan to sign up for various reasons: 1. I'm not selling anything, and won't sign up just for "moral support." (I tried this once before, getting an AMIX account early on, and that system offered more of a chance for a 2-way market. Still, a waste of my time.) --------------- I tried signing up for AMIX also, but unfortunately came in too late (after it closed down). I might consider signing up for a system with the characteristics described above for "moral support," but I will not do so for a system that I hope is replaced by a better one. --------------- 2. I wish Mark Twain Bank well, but the success of the kinds of digital cash we hope to see will not likely hinge on the success of one particular operations, such as MTB. 3. The success of BankAmericard (later renamed Visa) came when real customers and real shops started to use it, not when early pioneers set themselves up as clearinghouses and whatnot. --------------- Online commerce systems can be divided into four types, of increasing level of desirability (and decreasing level of governmental approval): A. Credit-card based systems such as credit card number encryption and First Virtual. B. Partially privacy-protecting systems such as ecash. C. Fully privacy-protecting systems with the characteristics described above, based on a governmental currency. D. Fully privacy-protecting systems with the characteristics described above, based on a privately-produced currency and backed by the issuer. I suspect that the first and second will have the most aboveground chance of succeeding, given likely governmental interference in the third and fourth; lack of public comprehension of all of the digital cash systems and of privately-produced currency will impede some of them also. However, the fourth may be a possibility for an "underground" currency system, to be used among computer-literate individuals with an aversion to government. I am currently creating an idea for a system of the fourth type, and will put it on the exi-essay list when it is complete. Incidentally, I suspect a privately-produced currency system may be harder to regulate than a governmentally-produced currency system, especially if the former is set up properly. I will explain further about this idea in the aforementioned exi-essay system. --------------- I have more interesting things to do, personally, than to be a pioneer so I can then have nothing to sell, and little to buy....when "interesting markets" start to appear, I'll look at it again. In any case, I wish all the pioneers well, and am happy to see Lucky Green's involvement. --------------- I also agree in wishing the "pioneers" well. The ecash system is definitely preferable to one based on means such as credit cards. -Allen

1 0

Re: Java & Netscape security (reply to misc. postings)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

After reading http://java.sun.com/1.0alpha3/doc/security/security.html my (possibly faulty) understanding of Java security is that it will not allow an applet to speak to IP addresses other than the one it was loaded from. I have a question: Doesn't restriction this prevent an applet from checking some ecash it has just received for validity with a bank computer? Thanks - Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

2 1

e$: Mandarins, Lifers, and Talents
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Bob, let me do a minor vent here. Fine, Tim. Vent away. In a minor key, even. >You are critical of E. Allen Smith's viewpoint, and essentially question >whether he has anything to sell. Not much of an argument. It's a damn good argument, which I'll get to in a minute. It was just done rudely, and for that I apologise to the list. What I got was a reactionary flame which had nothing to do with the (admittedly flag-waving) post I put up, which I should have ignored, but instead I responded with a reactionary flame of my own, which got me a reactionary flame from a Senior Member of the List, one with Maximum Reputation... It has been ever thus, for those of you who've been around here since I showed up a year ago last April. I just can't seem to color inside the lines, as far as Dr. May is concerned. >1. I'm not selling anything, and won't sign up just for "moral support." I believe that was my point, Tim. You're *not* selling anything. I was sending a message to people out there who *are*. People who are, or are going to, use non-certificate payment methods, like credit cards, and who, if they're subscribed to this list, should be clueful enough to do this and know why they should do it. Besides that, it's free. Until Friday. ;-). >2. I wish Mark Twain Bank well, but the success of the kinds of digital >cash we hope to see will not likely hinge on the success of one particular >operations, such as MTB. Nope. But if people completely ignored the Wright Brothers, would Curtiss have entered the market? (An interesting example, as the Wrights sued Curtiss for patent enfringement and lost, I think.) >3. The success of BankAmericard (later renamed Visa) came when real >customers and real shops started to use it, not when early pioneers set >themselves up as clearinghouses and whatnot. I am talking about real shops. With real customers. I bet you haven't even looked at the list of shops yet. What I'm planning to do is to offer subscriptions and sponsorships of the e$ lists we're putting up on an ecash server. Putting my money where my mouth is. Literally. >I have more interesting things to do, personally, than to be a pioneer so I >can then have nothing to sell, and little to buy....when "interesting >markets" start to appear, I'll look at it again. This is a straw man, Tim. Actually, it's post hoc. "If we had some ham, we could have some ham and eggs, if we had some eggs." or, "If we lived here, we'd be home now." Feh. You can do better than that. I've seen you do it. But, to answer your nonexistant point, yes, people *are* starting to sell things on the net. We know that the best way to do that in the long run is with cash, and with other digital bearer certificate technologies. Not just because these methods are secure. Not because they allow anonymity. They're just starting to, and when they've been accepted in the market, they will be nothing else but. All we need is a scenario where the digital cash underwriter relies upon the ATM system for validation of identity, and the second an anonymous bank account uses the underwriter, we have totally anonymous digital cash. We're very close here. >But when you urge people to be pioneers, and they express reservations or >doubts about the system, attacking their motives or implying they have >nothing to sell anyway is not too helpful. Yes. it was rude. I apologise both to the list, to Dr. May, and to (soon to be Dr.) Mr. Smith. Mostly for stopping discussion with a thinly veiled insult. >Just my views, but, then, I don't have any customers either. Which brings me to my real point, here. Why I used an informal fallacy of my own, and lashed out with an ad hominem attack against someone with an .edu domain on their e-mail address, after they dissed something I think is a good idea, at least for a start. So, why did I do this? I didn't understand it at the time, but it's probably class warfare. :-). I just heard something on an NPR(!) talkshow with a guy talking about his book about the three power group of american culture. It used to be what he called the "episcopacy", the Groton-Harvard-State Department types who ruled both government and the guts of American business until say, the depression and World War II. These people were there primarily there because their families were there. They were "the nice people of Boston" that Rose Kennedy had so many problems with. In 1953, say, it may interest you to know, that the standardized test scores for Harvard were the same as those for the population at large. George Bush was one of these, but so was FDR. Nowadays, this guy says, (I can't remember who he is, but he wrote a book about it, so we'll find out soon enough), we have *three* power elites in this country. The first class is the class he called the "mandarins". These people have inherited most of the trappings, and titles, of the old episcopacy. These are people who tested well, who were typically plucked from obscurity to go to the best schools, and go on to places like Harvard, where the scores are now way above average, and is now pretty much pure meritocracy as far as admission is concerned, political correctness aside. Mandarins go on to get advanced degrees. Camille Paglia, Milton Friedman, Carl Sagan, Billary Clinton are all mandarins. This is good. The best and the brightest get the best educations. They're also the people who start things like the Viet Nam war, and the welfare state. The second class are the "lifers". These people who go to state schools, get uninspired grades, and spend their working lives in the same institution. Colin Powell, most Fortune 500 CEOS circa 1983, Lyndon Johnson and Bob Dole are lifers. The third class are "talents". Newt, and Edison, and most computer or internet entrepreneurs are talents, especially if they have no formal computer science training except what they taught themselves. Like any set of categories, nobody is exclusively one class or another, except that credentialism has allowed mandarins to capture the cultural flag for the time being. Einstein and Whit Diffie are talents who got mandarin credentials. Richard Stallman is a talent who will probably get mandarin credentials posthumously.;-). Bill Gates is a proto-mandarin who figured out he was a talent. Sloan was a talent with mandarin credentials who created a whole industry full of lifers. Pioneers tend to be talents, Tim. They tend to talk in generalities, and not color between the lines. They tend to make up rules as they go along, and sometimes, like Mr. Bill, they create rules the rest of us have to follow whether we want to or not. One of my messier theories about the internet is that it was invented by mandarins. Now the talents, the people you call pioneers, have moved in, and they're much more pragmatic, and have little patience for crystalline perfection, because inefficiency and chaos is where they find beauty, joy, and all those other nasty imprecise concepts. When thing settle down a bit, the lifers will come. They're trying to do it now, by building sites like www.time.com, or buying into sites like www.wired.com. Even though you're an iconoclast, Tim, I couldn't help but think of you and the proto-Dr. Smith as mandarins when I got you're response to my post. I was trying to shout over your heads to all the talents out there trying to make money on the net. Even though you may think of yourself as a mountain man -- or maybe a cowboy -- watching the settlers come, I feel more like I've upset the decorum by hollering in the faculty tea room. Having embarrassed myself that way, I'll try not to do it again. Because, oddly enough, we need each other. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rich Salz 17 Dec '03

17 Dec '03

Status: R >as a compression program, but there's a key difference: the text >compressor *doesn't* need a key. Sure, 12 14 16, etc., bits as in the classic unix compress program. >The encryption tool would have an interface like > Boolean (*)( DataSource, DataSink, void*); > >A compressor written to the same interface would never need to touch >that third argument. Therefore, the second argument is "specifically >designed" to permit an encryption tool to be used. Not at all. coyping inbuf to output is a common practice, it's quite rare that you often compress in-place. /r$

1 0

Re: Public Domain?
by Andrew.Spring＠ping.be 17 Dec '03

17 Dec '03

>But the researchers backed out of the idea on the advice of our patent >lawyers. The reasoning goes like this: Sending anything over the Internet >is equivalent to placing it into the public domain, since the message can >be viewed by other than the intended recipient. So, proprietary >information *even encrypted* will be rendered unpatentable if sent over the >Internet. > You may want to send these guys back to do their homework. For corporate communications, crypto is not new. Messages have been sent in cipher over telegraph lines since the civil war. Ask if a trade secret becomes exposed (in the legal sense) if it is transmitted over telegraph lines in code. I fail to see what the difference is between enciphering something in dots and dashes and enciphering it in 1's and 0's.

1 0

Crypto++ port for Macintosh
by fluffy＠shout.net 17 Dec '03

17 Dec '03

I have started to port your crypto++ librairied to mac, using metrowerks. I was just wondering if you would like a copy of it when I finished? All in all, a very interesting set of classes. Chris

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 16 Nov 1995, Scott Brickner wrote: > You'd need a program which not only *accepted* the additional parameter, > but also *needed* the second parameter. I confess I have some difficulty > thinking of one. How about command-line compression options. Gzip, for example, allows you to specify how good you want the compression to be, with better compression taking longer. So you could justify passing a set of options to the compression algorithm, which could also be used to pass key information to the encryption algorithm. In fact, you could pass in a void * pointer to options that had been set up in a preferences panel in the application, which would be provided by the plug-in compression or encryption code. That structure could then have anything you wanted in it. Also, I'm not sure you'd need to pass a key, surely the encryption code could do all the key-handling itself ? Mark

1 0

GHO_mac
by John Young 17 Dec '03

17 Dec '03

The Sciences, November/December, 1995 Another realm of explosive population increase is in cyberspace, a phenomenon taken up in this issue with Sherry Turkle's "Ghosts in the Machine." Here the growth comes about not only in the traditional way but also in wildly non-traditional ways. People multiply themselves on the Internet, grafting various aspects of their personalities onto distinct characters. Even more unsettling, as Turkle wittily documents the matter, is that the Net is populated with "bots": robot sentence-parsing engines that can do fair impersonations of real people, often well enough to (provisionally) pass Alan M. Turing's test for machine consciousness. Do you really know who -- or what -- you're talking to? The future of all this is murky and mind-boggling: Information-seeking bots even now can tie up sites on the World-Wide Web. Bots impersonating people share chat groups with other bots, much the way telephone answering machines now "talk" to each other. Internet chatter gets so dense that bandwidth and other Net resources become strained: the site at the Los Alamos National Laboratory now (automatically) warns robots away with a chilling threat to "initiate automated 'seek and destroy' " action against the machine from which the robot seems to be launched. A conservative reaction may already be setting in, determined to have users identify, encrypt and authenticate every packet of information they send across the Net. Net fatigue becomes a recognized medical syndrome; Net detox centers spring up; Net warfare breaks out; Net starvation becomes a recognized social problem; Net demagogues undermine local democracies.... How many people can the Net support? -- Peter Brown, Editor ----- For "Ghost in the Machine" by Sherry Turkle, a professor of the sociology of science at the Massachusetts Institute of Technology. The article is adapted from her forthcoming book, *Life on the Screen: Identity in the Age of the Internet*, which is being published in November by Simon & Schuster: GHO_mac (16 kb) ... later this evening, that is.

1 0

Re: Need advice on video
by wiltship＠iccu6.ipswich.gil.com.au 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben wrote... <stuff deleted> >What I'm fishing for here are any suggestions for ways to present >some of this content in an interesting video setting. We've already >decided on doing some algorithm animation, and maybe some simple >moving graphics illustrating the various protocols. Any ideas you >might have would be appreciated. Firstly you will need to clearly define for yourself exactly what you want the audience to know by the end of the programme... the content. And what you want them to feel by the end of the programme too.. you obviously want them to have positive feelings about crypto. You might also consider some broader political issues to be cleanly interwoven through the script too. Then, you might like to think about the WHO, WHEN, WHERE and WHY of crypto. A bit of an historical background on cyphers would put todays crypto into context, too. Make sure that you keep giving the audience enough knowledge to comprehend stuff you will be presenting towards the end of the video... all of the information you present needs to build on what you have already presented. Closely examine your scripts for jargon. Take out any that you can't explain clearly. Too much jargon can swamp the audience and they will be distracted from important content while they try to remember what a particular word means. >BTW, once we finish this and show it locally, we are considering >doing some duplication to send out to interested bodies. Do you >think there is demand for a good, clear intro to all this in video >form? > I'm sure there is a need for this sort of programme that is produced well and is reasonably priced. Remember to get signed releases from EVERYONE involved in the project, not just ppl on camera, so you can sell the programme ANYWHERE IN THE WORLD if you choose to. Don't be misled, I'm sure there are quite a few programmes out there on this very topic. Yours needs to be significantly different and entertaining. I would suggest you have an opportunity to make a video from 'the inside', given the ppl on this list and the contacts they have. A lot of films sre good introductions to a subject without standing up and calling them such... like if I was making a video about Phil I would have to explain crypto and its use as a way of reaching a level of understanding for the audience. Hope this is of some help. >Thanks, >-- > eebmoC .L nimajneB | Benjamin L. Combee (REVERSE) > gro.doowhcet@eebmoc | combee(a)techwood.org (ENGINEERING) >\eebmoc\ten.kay.www\\:ptth | http://www.yak.net/combee/ (RESERVE) > Cheers Peter -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKu5bOvjRao+WEx9AQHKhQQAhOGT7fecYsaiwCDa6d8Ka7J6Hsgwuw5D tcknrSNVZGSf3+GCHWWVvCgsqHbgd+T9W/xFE9wlwzBmnbL9OwLb8sGr6yYDljL4 KH474GmKrax2hmu3h24J7HbsdTGDwj/KTrWnW4Kc+5TVIdhe0TM7SQBAMfWsYhuP 2YaxW3QYoTg= =zt0k -----END PGP SIGNATURE----- Flight to Quality Wiltshire Productions Pty Ltd Brisbane, Queensland, Australia Intl Voice 61 7 3376 3535 Intl Fax 61 7 3279 4027 Email wiltship(a)gil.com.au PGP Key ID 3E584C7D PGP Fingerprint 01 03 FB F4 BE F8 2B F3 5D 84 6B 69 37 80 FE 10

1 0

Mark Twain Bank ecash scripts needed
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I am in the process of setting up a shop using Mark Twain Bank Ecash. Could someone please forward me the scripts to accept Ecash (running on SunOS. On c2.org actually) and/or any advice you have about how to expeditiously implement a shop? I am about to fax MTB the agreement form, so I should get information from them "within 24 hours", but that is cutting it awfully close to the Friday deadline for the US$300.00 fee waiver. Many thanks! Bryce signatures follow "To strive, to seek, to find and not to yield." <a href="http://www-ugrad.cs.colorado.edu/~wilcoxb/Niche.html"> bryce(a)colorado.edu </a> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMKvIGfWZSllhfG25AQElIQP+McHbg+ZCWMhSZ0YDDFwHE/TVhlAPrNX5 Oh2/8n3IirDb3KePXlvSdXAtCXS9ROuHSMqN9UQ0cPX9kOdgFMomwvsCqo9G5eZ0 Tan+9IW0WcvtntJ+8DFIN5jhlEbT5b+HRlKul1SkImezFM1kRDM4qqD1LD6srGRe NEV32AZG1dU= =A6lY -----END PGP SIGNATURE-----

1 0

Denver area meeting, SUNDAY, Nov. 19, 2 pm
by awestrop＠nyx10.cs.du.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Once again, we'll begin in the basement of the Tivoli, at downtown Denver's Auraria Campus, and perhaps wander elsewhere. Drop me a note if you need directions or more info. Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKvVWFRRFMq4NZY5AQGDngP/XVXubqwKaFIa+Exo75BYjyKADVZI33tX tOugaQG8Swla6wyPiUOfdTUdF49ZRHnVbowGw3o33k+3dMlfiC/ng2JqGOAyS9NR zVUzIrPROMEBLS69FuLmaYDO/38dG5Xoqfir44qXm50mcEtfCZO7ILbG4dVKGBEI 0FxI3tAPTDU= =njUa -----END PGP SIGNATURE-----

1 0

The Great FAQ Hunt
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Several fellow newbies have written me asking to share the sources I received re: where to get the uncorrupted Cypherpunk FAQ (Cyphernomicon). You can get it uncompressed-- along with a lot of other cool stuff, like the Applied Crypto book--at Pat Farrell's Web Site (thanks, Pat!) http://www.isse.gmu.edu/~pfarrell/crypto.html However, when I tried to summon up this 1.2 MB tome with Netscape, my computer choked. Changing the cache settings didn't seem to help, so I wound up downloading it via FTP from ftp.netcom.com /pub/tc/tcmay where you can also get your hands on the shorter MFAQ (Most Frequently Asked Questions). Hope this helps. I'm on an info-diet, Cypherpunk Lite, so if you want to respond to this message, please be sure to "cc" me directly. Cassiel

1 0

Re: e$: Mandarins, Lifers, and Talents
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>It really did not happen because of cheerleaders. This is a recurring >belief of mine, notably in my occasional interactions with the nanotech >community, as a few members of this list can attest to. The "Rah, Rah"s--no >pun intended--play a minor role in adoption of new products and >technologies. Tim, you can't tell me that there weren't people who were just plain fired up about the prospects for any really serious technology. Where are you living, the Gernsbeck Continuum? Tim, those "cheerleaders" are the ones who either get fired up to do something themselves, or if they can't, they get people either fired up to buy stuff, or fired up to build stuff. Howard Hughes was one. Hell, the Wright brothers were. So are you, Tim, only your passion is strong crypto and cryptoanarchy. Mine is this geodesic market stuff... >One argument I am never persuaded by is the hackerish "Feh." (Does anybody >but hackers use this strange word?) Ah. Well, Tim, "Feh" is yiddish, actually. Just like "hacker" comes from electric trains. If you don't believe me on *that* one, ask Mr. Levy, who knows all about the MIT Model Railroading Club... >In any case, I'm not interested in "doing better than that." My support for >Chaumian e-cash goes back to 1987. As to why I didn't sign up for Magic >Money, or E-Purse, of Digibux, or whatever, well, I'm not a merchant. Just >as one could study flight, to use Bob's example, without operating a >passenger service or a flying school, so one can be interested in digital >cash without "opening an account." Right on, Tim. Just don't rain on my parade, or anyone else who's trying to make something happen, for that matter. >Ah, but I never claimed otherwise (perhaps this is what you mean by "your >nonexistant point"). My point was only that digital cash will happen mostly >when it fills a need, or is accepted by customers, not by cheerleading and >by urging people on this list to be pioneers. Cart before the horse, Tim. Most of the new people (say, for 2 years at least) on this list *are* pioneers. I've got 600 people over on www-buyinfo who are there primarily because 90% (!) of the traffic on it is my e$-filtered cross-posts from cypherpunks, and I don't know how many are over here because they like their whiskey neat. Those people are so fired up, they will find a need, or *create* one, if they have to. >The theories about mandarins, lifers, and talents I'll discuss at another >time, maybe. All I'll say is that I think it's too simple a categorization. >Maybe it's a Boston viewpoint. Damn Yankees. Born in El Paso, myself, by way of St. Thomas, Las Cruces, Corpus Christi, El Paso, Anchorage, St. Louis, Mid-MO, Chicago, and yes, Boston. Never knew I was one until you told me... >The folks I've worked with over the years >bear almost no resemblance to any of these categories. Typical Mandarin response. ;-). (just pulling your leg, Tim. Put the Glock *down*...) >In any case, people >will start using digital cash if and when it fulfills some need, or some >need they never knew they had, gets stimulated. Agreed. > >On a personal note--which is weird, since 1000 or more people may be >reading this message, though most probably haven't read this far--I think >it best not to get too emotionally attached to some particular outcome in >the introduction of a new technology. I bet they are, but I'm not attached to Mark Twain or even Digicash per se. It just seems to me, that if you want to get involved in this flying stuff, here's a plane that flies, even if its elevators are stuck on the front. Learn to fly now, and be able to fly the new stuff as it becomes available. If you want to fly, that is. Some people then couldn't help it. They *had* to do it. That's what's happening here, Tim. >I've seen many "prophets" wailing to the world that their >visions _deserve_ success. Not here Tim. I believe you might be projecting, or something. I just want to sell stuff for cash on the net. Then, I want to surfact the financial markets into little tiny pieces... >The technologies which hit the right chord rarely need, or benefit from, >the "evangelists" and "cheerleaders." The Macintosh did not Guy Kawasaki or >any of the other so-called evangelists to succeed. The microprocessor did >not evangelists. The airplane did not. The VCR did not. The cellular phone >did not. I don't believe that for a minute, and on reflection, you probably don't either. Jerry Sanders at AMD. Hell, Tim, you knew Moore, for god's sake. Think about, oh, the Sony guy, whatever his name is, Morita. The people who built the Mac were *possessed*. So was Kawasaki. I'm *still* possessed. What about the *entrepreneur's* reality distortion field. I bet you've seen more than a few, and probably more than a few who were right, or you wouldn't be thrashing your Mac on the net and clipping coupons... >And I can think immediately of several >technologies that had active proselytizers--Ted Nelson, Doug Engelbart, >Marty Lepselter, Steve Jobs, Eric Drexler, fusion enthusiasts, space ^^^^^ >enthusiasts--but in which progress has been stalled or proceeded along ^^^^^^^^^^^^ >different paths for different reasons. I resemble that remark. Sure, Tim some of them didn't make it. But for every one of those (strange you should mention Jobs, right after I mention the reality distortion field, and don't count him out yet, rumor has it Ellison wants him to run Apple when Oracle buys it, god help us all), there are others who did exactly that. Von Braun, or Porsche, or, hell, all I can think of are germans, uh, okay, Bill Gates. >This is a very interesting area for me, and I used to write extensively >about it. Nick Szabo and I had several debates about this, a couple of >years ago. However, no time now to discuss the full implications here. Having been hammered by Nick myself, once or twice, I think I understand this... So. I'm enthused. My enthusiasm is demonstrably contagious. If someone gets enthusiastic about all this on my account, and puts up the king-hell, world-beater, financial-cryptography-killer-ap that's cool by me. Otherwise, it's only bandwidth, which I've wasted enough on for this thread. If you want to make the rubble bounce, go for it. Besides, I usually stay in my cage, these days. Which is where I'm going to go and lurk for another month or so... Cheers, Bob Hettinga PS: Feh ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

2 1

Re: e$: Mandarins, Lifers, and Talents
by tcmay＠got.net 17 Dec '03

17 Dec '03

Lots of different issues here.... At 9:02 PM 11/16/95, Robert Hettinga wrote: >Reputation... It has been ever thus, for those of you who've been around >here since I showed up a year ago last April. I just can't seem to color >inside the lines, as far as Dr. May is concerned. Unfair, unfair! I don't plan to dig up old posts where I said good things about Bob's posts, but I know I have. His style differs from mine, of course, but I usually avoid critiquing mere styles. On to some other points in Bob's post: (quoting me) >>2. I wish Mark Twain Bank well, but the success of the kinds of digital >>cash we hope to see will not likely hinge on the success of one particular >>operations, such as MTB. > >Nope. But if people completely ignored the Wright Brothers, would Curtiss >have entered the market? (An interesting example, as the Wrights sued >Curtiss for patent enfringement and lost, I think.) "Flight" is a very interesting example to consider. Flight happened for a lot of reaons, including technological feasibility, relatively low entry costs, willingness of customers to pay for faster travel, etc. It really did not happen because of cheerleaders. This is a recurring belief of mine, notably in my occasional interactions with the nanotech community, as a few members of this list can attest to. The "Rah, Rah"s--no pun intended--play a minor role in adoption of new products and technologies. >>I have more interesting things to do, personally, than to be a pioneer so I >>can then have nothing to sell, and little to buy....when "interesting >>markets" start to appear, I'll look at it again. > >This is a straw man, Tim. Actually, it's post hoc. "If we had some ham, we >could have some ham and eggs, if we had some eggs." or, "If we lived here, >we'd be home now." Feh. You can do better than that. I've seen you do it. One argument I am never persuaded by is the hackerish "Feh." (Does anybody but hackers use this strange word?) In any case, I'm not interested in "doing better than that." My support for Chaumian e-cash goes back to 1987. As to why I didn't sign up for Magic Money, or E-Purse, of Digibux, or whatever, well, I'm not a merchant. Just as one could study flight, to use Bob's example, without operating a passenger service or a flying school, so one can be interested in digital cash without "opening an account." >But, to answer your nonexistant point, yes, people *are* starting to sell >things on the net. We know that the best way to do that in the long run is ... Ah, but I never claimed otherwise (perhaps this is what you mean by "your nonexistant point"). My point was only that digital cash will happen mostly when it fills a need, or is accepted by customers, not by cheerleading and by urging people on this list to be pioneers. (And actually I have nothing against urging people to be pioneers. Or cheerleading. It doesn't consume much list bandwidth and it may actually help get someone started. Which is why I didn't call for an end to cheerleading and pioneer-recruiting.) The theories about mandarins, lifers, and talents I'll discuss at another time, maybe. All I'll say is that I think it's too simple a categorization. Maybe it's a Boston viewpoint. The folks I've worked with over the years bear almost no resemblance to any of these categories. In any case, people will start using digital cash if and when it fulfills some need, or some need they never knew they had, gets stimulated. On a personal note--which is weird, since 1000 or more people may be reading this message, though most probably haven't read this far--I think it best not to get too emotionally attached to some particular outcome in the introduction of a new technology. Most product and technology successes are essentially unpredictable, and many things thought to be sure things are failures. I've seen many "prophets" wailing to the world that their visions _deserve_ success. The technologies which hit the right chord rarely need, or benefit from, the "evangelists" and "cheerleaders." The Macintosh did not Guy Kawasaki or any of the other so-called evangelists to succeed. The microprocessor did not evangelists. The airplane did not. The VCR did not. The cellular phone did not. In fact, I can't think of an example of a major technology that _did_ depend critically on cheerleaders and evangelists. Some examples may exist, but they seem to be rare. And I can think immediately of several technologies that had active proselytizers--Ted Nelson, Doug Engelbart, Marty Lepselter, Steve Jobs, Eric Drexler, fusion enthusiasts, space enthusiasts--but in which progress has been stalled or proceeded along different paths for different reasons. This is a very interesting area for me, and I used to write extensively about it. Nick Szabo and I had several debates about this, a couple of years ago. However, no time now to discuss the full implications here. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: The Great FAQ Hunt
by tcmay＠got.net 17 Dec '03

17 Dec '03

I answer questions about my megabyte-long "Cyphernomicon" FAQ every few months, so I guess it's that time again. At 11:19 PM 11/16/95, Cassiel wrote: >Several fellow newbies have written me asking to share >the sources I received re: where to get the uncorrupted >Cypherpunk FAQ (Cyphernomicon). You can get it uncompressed-- >along with a lot of other cool stuff, like the Applied >Crypto book--at Pat Farrell's Web Site (thanks, Pat!) > >http://www.isse.gmu.edu/~pfarrell/crypto.html > >However, when I tried to summon up this 1.2 MB tome with >Netscape, my computer choked. Changing the cache settings >didn't seem to help, so I wound up downloading it via FTP >from > >ftp.netcom.com /pub/tc/tcmay > >where you can also get your hands on the shorter MFAQ (Most >Frequently Asked Questions). My "Cyphernomicon" FAQ, and various shorter and compressed versions, are available, actually, in several places. The site I tell people about most often is Jonathan Rochkind's excellent HTML version at the URL: http://www.oberlin.edu/~brchkind/cyphernomicon/ I recommend that people use their browsers to read it at this URL. To those who want to download the whole thing and print it out, I have one question: "Are you on drugs?" (I have gotten complaints from people who tried to print it out and gave up after 200 pages, somehow blaming me for it being too long. Use computerized search tools!) Searching for "Cyphernomicon" with InfoSeek, Excite, Lycos, or other search tools will show numerous places it may be found. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: COE Recommendation No. R (95) 13
by smithmi＠dev.prodigy.com 17 Dec '03

17 Dec '03

>MS> However, if I have a wall safe and >MS> they get a warrant to search it, can I be jailed for contempt if I >MS> don't give them the combination? > > Well, IANAL, but yes, I believe that you can be. Or, worse, >obstruction of justice. Especially if they cut it open and find that >the knife was in the safe. So presumably the same would apply to the password that unlocks my PGP private key. But there's an interesting twist. Once they open up the wall safe, they can see for sure what is and isn't in it. This ain't necessarily so for an encrypted file. Suppose my software has the fiendish sophistication to disgorge different keys depending on what password was given, and different pieces of cleartext depending on what key was used. (Again, I apologize if this notion has already been extensively discussed.) Is there a way to set it up such that the cops couldn't be sure -- even using a logic analyzer -- that I hadn't given them the complete set of keys, so as to read all the cleartexts in the file? Assume that cyphertext files are guaranteed to be larger, by some random factor, than the sum of all the cleartexts in them, so the mere fact that a smaller quantity of cleartext was disgorged than cyphertext supplied would tell them nothing. I guess this is a kind of steganography, isn't it? Or at least something similar -- the point would be that they couldn't tell genuine cyphertext from camouflaging noise, without the key that tells them where to look. Which brings us, in turn, to the bottom line: the only things we can be certain the bad guys _won't_ do, are the things they _can't_ do. --Michael Smith smithmi(a)dev.prodigy.com

1 0

Cornell Cracks Down on Private E-MAIL...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by pcw(a)access.digex.net (Peter Wayner) on Fri, 17 Nov 9:47 AM ---------- The New York Times, November 17, 1995, p. B8. Penalties Decided in E-Mail at Cornell Cornell University has reached agreement with four students on punishment for a widely distributed E-mail message they wrote listing "75 reasons why women should not have freedom of speech." The university rejected harsh penalties like suspension because the students did not engage in sexual harassment, university officials said yesterday. The university had investigated complaints of sexual harassment and misuse of computer resources after the message made its way on the Internet last month, angering thousands of computer users who sent angry responses to the four students. The message included the lines, "If she can't speak, she can't cry rape" and, "Of course, if she can't speak, she can't say no." The university said the students had agreed to attend a program dealing with date and acquaintance rape, and would perform 50 hours of community service. ----- There was a somewhat longer NYT article a day or two ago; anybody want it, send your PIN_kie.

1 0

Re: Java & Netscape security [NOISE]
by schampeo＠imonics.com 17 Dec '03

17 Dec '03

<plonk>! I'm so tired of listening to this no-researching, no-paying-attention, out-to-make-money freak I just can't stand it. Consider Mr. fc(a)all.net hereby removed from my mailbox by virtue of the autofiltering capability of my lovely mailreader. Fred: *RTFWP* and stop complaining about things you know nothing about. Feh. Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

2 1

Security via Sounding Impressive
by szabo＠netcom.com 17 Dec '03

17 Dec '03

I've notice an interesting pattern in how security mechanisms are named. On the one hand, we have some security features with very impressive sounding names: Certification *Authority* *Authorization* *Trusted* Server *Master* Key etc. These words fill most people (many on this list are exceptions) with awe and good will towards the feature so named. They also make good channel markers, pointing out the _insecure_ parts of the system. The effect is to cover up the lack or inadequecy of a mechanism with invocations that put your brain to sleep. This is quite lucrative for marketing purposes, but it works on many designers of security features as well! On the other hand, when we isolate the actual mechanisms of a system are in fact mathematically secure, we get names like: Encryption Blinding Message Digest Mix Capability These are just plain, boring words, with no connotation that we should trust them like we trust our big brother. They just work. Nick Szabo szabo(a)netcom.com Internet Commerce & Security consulting -- e-mail for details

1 0

Re: e$: Come aaaannnndddd Get it!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:20 AM 11/17/95, sameer wrote: >> >> 3. The success of BankAmericard (later renamed Visa) came when real >> customers and real shops started to use it, not when early pioneers set >> themselves up as clearinghouses and whatnot. > > I'm sorry, but Community ConneXion is a real shop, with real >customers, selling real services, and we accept ecash. You guys are getting way too sensitive about all this. I'm in favor of real shops selling real things or real services. My point was that there is no compelling need to get people to sign up just for moral support. Lighten up. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Mark Twain Bank ecash scripts needed
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:25 PM 11/16/95 -0700, Bryce wrote: >I am in the process of setting up a shop using Mark Twain Bank >Ecash. Could someone please forward me the scripts to accept Ecash >(running on SunOS. On c2.org actually) and/or any advice you have http://www.digicash.nl/mt/ #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

e$: Financial Cryptography for Dogs, pt. 2. OpenDoc Kitchen, anyone?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

As a result of my temporary notoriety as OpenDoc Futurist(tm) ;-), I've heard about something called an OpenDoc Kitchen, which is a periodic hack fest put on by Apple for developers of OpenDoc parts where code is actually written. My understanding is that this will be held at Apple, in Cupertino, in early December. They are especially interested in anyone from Digicash who would like to make a digital cash OpenDoc component for Cyberdog, because I've been ranting to them about this picture in my head of someone dragging digital cash icons onto a register icon in a web browser to pay for a purchase. I expect that *any* digital cash part, even some kind of bashing of the current Mac ecash client into an OpenDoc part, would be cool by them as a first start. In addition, it seems to me that we may be close enough with MacPGP 3.0 to play with it at the component level, but maybe not... If you're interested, e-mail me, and I'll put you in touch with the right people. Now, the invitations have already been sent and RSVP'd on this, so we'd be coming in through the back door. Obviously, we're looking to put the best foot forward, as they are just about to the point of believing my mantra of "digital commerce *is* financial cryptography". I'm hoping to go, if there's something to do. I couldn't code my way out of a paper bag, but like the immortal Chauncey Gardener, "I like to watch." ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Ecash account
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

So who here is going to use their ecash account to set up a money lau^H^H^Hexchange service? Ob Cyphernoise: Would Dr Fred, Alice, and any other names LD has set up for himself lately please keep the noise limited to email? Please? Ob Plonk: amen. So let it be written, so let it be plonked. Don

2 1